Fixes: unauthenticated users can see import-action (#731).