added admin controls, restrictions,  user sessions with auth tokens