users can add regions

I think a better name is `ensure_admin`. I usually name `before_action`s with `ensure_......`