wip: fix security for api updating answer flags and tags