check permission for admin