controllers check for admin privilege when destroying, updating or
editing