restrict view elements and controllers to whether admin logged-in