Only allow admins to see the user object