limited access to admin page using rails callback facility