require admin on the controllers