don't block all grants url to admin