Restrict access to /admin to users with admin role only in routes.rb