add permissions check for admin area