admin pages permission check

do you want us to do this in the API instead of on the front end?