added 'sign out'/'sign in' link to the index page
fixed abilities so that non-admin users cannot access the backend