Updated routes. Added permission check for /admin/users.