limit /config to admin