Added more permission checks for admin-only actions