add authorization to restrict user access to admin pages