clean up
add admin authentication to admins controller
keep dry. apply authenticate for all controllers except new session controller