fixed route
added authentication to controllers
added admin pages for users