only allow administrators to play media on the backend (fixes #195)