initial authorization for admins