add auth to handlers for admin functions