@jscholes @JenMsft your periodic reminder that the client (software) is not to be trusted. Forget the fact that someone might figure out the right thing to put into `curl`, the browser will let them rewrite your forms and submit!
I got my kid into a summer program because they only disabled sign-ups in the front-end code. I mean, I still paid the people, obviously…