test that admin users can access /admin