fix invalid user link. only accessible to admin