restricts admin page with session id