Shunt admin_required unless production; crummy stand-in for legit development auth strategy