make everything not in dev, test or production require authentication
make sure admin controller still gets authenticated in production