Add testing for insecure admin routes post