restrict access to settings page for admin