security on Admin menu (refs: #645)