adding admin authorization to some API methods