proper admin page permissions checks