corrected access for user and admin