Admin-only actions now force admin user