add user permission check in admin/product