Comment by carlsverre

done - but since no server side controls it's not possible to completely enforce