Move Admin area security to base controller.

There is no way to secure access to controllers in MVC based on their area
(you cannot configure authorisation for a whole area, sadly), and it seems
the recommended solution is this: create an abstract base controller that
defines the security requirements for the area, and ensure all controllers
in the area inherit from it.