always require auth if admin is required