* SECURITY: moderator shouldn't be able to import a theme via API. * DEV: apply `AdminConstraint` for all the "themes" routes. Co-authored-by: Vinoth Kannan <svkn.87@gmail.com>