[Building Sakai] Email link to Quiz -> submit = admin access?

[Wheat, Jon]

Had an instructor tell me one of his students told him that after he takes an assessment - he can edit assessments!

I had the instructor add me (my non-admin account) to the course and I'd investigate next assessment.  Just did it and verified the student's claims.

This is what happens -
A professor sends out messages when a quiz is ready to take - its the normal notification email - looks like this -

=====
"Lecture Quiz #08" is available on 04/26/2013 01:00:00 PM to the entire class at https://sakai.messiah.edu/samigo-app/servlet/Login?id=9c2389f5-114b-41c1-8e8c-77b9dd17873e1367246668644
It is due 05/03/2013 05:00:00 PM.
The time limit is 0 hr, 30 min. This assessment will be submitted when time is up. Students can submit this 2 time(s). (The highest score will be recorded).
Student will receive feedback on submission.
Find this assessment at the "BIOL_258_01_201220" site on https://sakai.messiah.edu/portal.
========

I clicked the link - log in as a student (my non-admin account)
I take the assessment "frameless" - meaning there's no sakai wrap around this page. / no heading / left nav, just white with questions.
Submit it for grading
Asks if I'm sure - I say yes
It passes me off to this url -
https://sakai.messiah.edu/portal/tool/78122cc7-2a6c-4a3a-8431-87cd834907d6/jsf/index/mainIndex

And I can see the Instuctor view (attached) - and can as a student - edit assessments and all the other items an instructor can.
I copy that url paste it into another browser, log in with the same user account and see just the student view (also attached)
Any idea how this is possible?

Using Sakai 2.8.2 (Kernel 1.2.6) on Linux, 2 server configuration, 1 database

-Jon

==============================================
Jonathan Wheat
Messiah College, Information Services Group
Spam me: jwheat at messiah.edu<mailto:jwheat at messiah.edu>
Stalk me : @jonathanpwheat<http://twitter.com/@jonathanpwheat>
Read me : codedog.net<http://codedog.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20130429/c582d86c/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sakai_copy_url_new_browser.png
Type: image/png
Size: 197000 bytes
Desc: sakai_copy_url_new_browser.png
Url : http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20130429/c582d86c/attachment.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sakai_edit_assessment_screen.png
Type: image/png
Size: 262798 bytes
Desc: sakai_edit_assessment_screen.png
Url : http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20130429/c582d86c/attachment-0001.png