Being signed in is not the same as being an operator. Access is decided by the server on every request.