add admin flag to users(database)
protect user pages unless user is admin or that user