mvc c# url change makes me signed in as another user, how to prevent this?

See more:

C#

MVC

I am using following code for user authentication

Home Controller:
    ------------------
    [AllowAnonymous]
    [HttpPost]
    public JsonResult JsonLogin(SecurityDTO usr)
    {
        var cnt = _ipres.CheckLoginCount(usr);

        if (cnt == 1)
        {
            var logDet = _ipres.GetUser(usr);
            if (logDet != null)
            {
                var dto = new SecurityDTO
                {
                    Id = logDet.Id,
                    UserName = logDet.username,
                    Password = logDet.password,
                    Email = logDet.Emailid,
                    UTID = logDet.UTID,
                };
                Session[USER] = dto;
            }
            if (logDet != null)
            {
                switch (logDet.UTID)
                {
                    case 1:
                        Session["UType"] = "admin";
                        return Json(new { success = true, redirect = Url.Action("Index", "Admin", new { area = "Admin" }) });
                    case 2:
                        Session["UType"] = "user";
                        return Json(new { success = true, redirect = Url.Action("Index", "User", new { area = "User" }) });
                    case 3:
                        Session["UType"] = "client";
                        return Json(new { success = true, redirect = Url.Action("Index", "Client", new { area = "Client" }) });
                    default:
                        Session["UType"] = null;
                        break;
                }
            }
        }
        else
        {
            ModelState.AddModelError("", "Invalid Username or Password");
        }

        return Json(new { errors = GetErrorsFromModelState() });
    }

    Base Controller:
    ------------------
    public SecurityDTO UDTO { get; set; }

    protected override void OnActionExecuting(ActionExecutingContext act)
    {
        if (Session["UType"] != null)
        {
            UDTO = (SecurityDTO)Session[HomeController.USER];
            base.OnActionExecuting(act);
        }
        else
            act.Result = RedirectToAction("Index", "Home", new { area = "" });
    }

This works pretty well for authentication. After successful login I redirect the user to an area according to his user type. All controllers in area implement base controller. Lately I found this not effective because of following reason. When I logged in as user my url will be ~/AppName/User/User/ViewName. But when I do some tampering with url and change it as ~/AppName/Admin/Admin/ViewName it takes me to that page even though I am not an admin user. I am still logged in as user but I have access to all admin features. Basically when I change user type in url it considers me as that user type. But intended behaviour is to redirect the user to login page when url tampering occurs like this. Can I do something like recognising user type change in base controller and redirect the user to login page? please show the right way to do this... Thanks in advance.