AccessController: admin check added