finished ep17a: fixed a security hole that a user can edit itself to be admin by editing the html form from client side before submitting.