Right now we allow force push on all branches, we should add a way in the settings to turn force-push off.
ok we can do this simply via a pre-receive git hook. I have the code locally.
Implemented in https://pagure.io/pagure/pull-request/825
/cc @sochotni