allow update.cfm in admin