locked down all admin routes 

only admins can access admin routes