only admin can access to user management, a few form tweaks