locks down some actions to admin users