Claim scripts are used by actions

So REQUEST is always part of the post, those scripts have don't have manager role, so we should rely on normal security