fixed security vulnerability, check server-side too if I'm admin