add_submission_to_leaderboard does not authenticate per user

Any user can send a post request to add any submission to any leaderboard, even if they are not the owner of the submission.