restrict users listing page access to admin only