[fix] user can access admin functions