admin now returns 403 correctly when not logged in, not 404