restrict access to the functions in the admin controller