only allow admins to access feature_images controller