do not allow admin to see other user's credential information