fix user permission, normal user can't show admin