switched back flag to ensure user is admin