restrict settings to admins