only allow changing certain fields in post