help with role based authentication

[eluser]jbreitweiser[/eluser]
Both techniques should be used. Do not show people buttons there not supposed to use because they will try them, even if it is just to see what it does. But you should also throw an error on the page because you can alway dummy up a post that simulates clicking the button with some common tools from the internet.