Fix authorization

Admins can do everything. That's their purpose