protect admin pages on the client