people with TRAC_ADMIN should be pass in permission check