added admin checks to new controllers