client: apply access control for admin users
client: refactor out common code