As I was testing my new CMS, a user pointed out that he could choose commands that were disabled and they would run. That's why it's good to have other people testing, because this isn't something I, as a user, would ever think to do.

It's not harmful, because there are protections on the server, but it is wrong and embarrassing. 

Today I fixed the problem once and for all. 

And I wanted to make it public and point to it here so no one else has to reinvent this little wheel. 

Thanks Google et al for indexing the gist containing the source.