move towards more sane permissions on admin stuff