fix access control in admin module and clenaup _form.php