updated so only the admin can enumerate clients

this fixes #21 
I just want a solution that forces users to have a certain role. It would be difficult to put this in the model because the model would need to understand where the call is coming from to know what to validate.