Added admin action permissions checking so users cannot post fake requests