ensure that minions can't spoof local_cmd and locals can't

spoof remote cmds