administration functions now require login