Investigate: potential ways of preventing malicious contracts from being loaded

[taoeffect]

Problem

It is possible for someone to upload both contracts and contract manifests as files to the server, and then, for example, using either a malicious invite link (that references a groupid that uses these manifests), or possibly by registering their username with a modified identity contract, to get malicious contracts to load on the client.

Solution

Look into ways to restrict contract manifests from being uploaded by users, so that only the developers are apps are allowed to define contract manifests for their apps.