user cannot directly visit URL of admin only pages