Change admin flag into Rails AR enum
Prevent unauthorized access to appointments