fixed problem of locking list action on controller to only admins