Moved the admin authorization logic from the controller to the model