Routes and linking only takes login into account, not authorization level of the user

Currently it is possible to access the admin user list,listing all user information, as a newly created user.