protecting admin pages on client side