lock down admin functions to admins