lock down update/creation functions to admin users.