corrected permissions logic for adminonly