The is_admin() function is not supposed to tell whether a user is an administrator or not, it tells whether the user is looking at one of the administration pages. As such, this function does exactly what it is supposed to do.

As for the rest, there is no flaw. To view a draft, the user must auth...

[ more ]