more work on securing routes: showing and hiding buttons for manage/admin