- secure all pages under /admin