index routes list current_user's resources, hide 'new' routes from non-admin users