tiny auth allowAdmin and cleanup