Replace a few is_admin? checks with can? calls, close #976.