Another security issue

This really is a -dev release, I'm wondering why this is published on d.o...

The module defines menu callbacks to empty the points/buy tables but explicitly allows everyone to access it.