fix #122 admin security bug