lots of little fixes and now access restrictions enforced on all admin apis