non-admins cannot view user index, they are met with a notice saying not authorized