Security problem with the xar import

When importing a XAR in a wiki, there is no verfication that the user who make the import
has the same level of rights as the users that are listed in the pages inside the xar.

So, if a user imports specially crafted xar, he can creates pages with groovy code that will
be executed as more privileged users (for example farm's admins)