restrict non-admin routes