prevent non-admins from viewing Rails admin