[gh-435] Non-admin users can edit the module whitelist

This is bad.