added admin-check and CSRF-token