protect report and backend with admin flag on User