fix security hole for non-admin users being able to access config pages