fixed current_user.admin in _header (verify user first)