Put this in your server.cfg

You need to put sv_allowcslua 0 if you have it on 1 put people can use client-side hacks, they can make themselves admin.