add admin? helper and protect PostsController actions