restrict permissions to superadmin
fixes #58. fixes #59