fixing security permission logic to ensure admins always have access