fix admin controller security