fix admin can see users