a27b8018b1
Any authenticated user could previously call PUT /update/role and escalate their own role to Admin. The endpoint now returns 403 if the requesting user is not already an Admin.