adding auth restrictions to admin section