* use class decorator to check admin permission