fixed error where anyone could access custom admin pages