small tweak to auth rules for bundle admin