authenticate admin in controllers, some code clean-up