user: allow admins to see profiles