diff --git a/cmd/web/savesetuphandler.go b/cmd/web/savesetuphandler.go
index 21638eb..0b8ba66 100644
--- a/cmd/web/savesetuphandler.go
+++ b/cmd/web/savesetuphandler.go
@@ -13,6 +13,11 @@ import (
 )
 
 func saveSetupHandler(w http.ResponseWriter, r *http.Request) {
+	if !ValidateJWTFromCookie(r, appKey) {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
 	r.ParseForm()
 	nextSession := r.FormValue("nextSession")
 	incDays := r.FormValue("incDays")