I was trying to stop someone from setting dev and rev to a random string, which I was able to do via curl (curl -X POST 'http://localhost:5000/user/acl' -d 'id=1&dev=this&rev=shouldnt&admin=work').  It was the first thing that came to mind.  Also I figured they should be booleans not strings.  I might be looking at this the wrong way?