disable PUT and POST requests on public sessions

[suhlrich]

People seem to regularly try to reprocess the example sessions on the website, fail, then the trials get error'd and our app looks like it doesn't work. We should disable any writing to public sessions unless Owner or Admin.