Protect training urls

Right now everyone and their brother can initiate retraining of models with correct url.

train/everything should be admin limited (whatever that ends up meaning)
train/user should at least be rate limited. Doesn't hurt to admin limit them for now too.