dont call isAdmin if not logged in