constrain admin namespace inside admin subdomain