security: restrict admin commands to admin users only