validate user logins and check admin before action