Fix URLS for admin pages and raise PermissionDenied when non-staff users attempt to use it