validate user is admin or not