- remove command from index (so that pvesh does not list it)
- use POST instead of GET
- correctly check permissions
- return value with status codes and data (allow expections)