block direct access to admin pages without loging in