added restrictions to admin controller