restricting api to admin users