fixed admin path disclosure