restrict files for admin to current site assets