add security rules for admin and user