diff --git a/index.js b/index.js
index <HASH>..<HASH> 100644
--- a/index.js
+++ b/index.js
@@ -375,7 +375,7 @@ function pages(options, callback) {
                 // The new syntax for aposArea() requires a more convincing fake page!
                 // Populate slug and permissions correctly
                 req.extras[item] = page ? page : { slug: item };
-                if (!page) {
+                if (!page && req.user && req.user.permissions.admin) {
                   req.extras[item]._edit = true;
                 }
                 return callback(null);
fixed a bug where the edit controls for `global` areas and singletons appeared before an admin logged in (if global did not yet exist). You could not actually edit it (not a security flaw).