Admin areas secured, though role lookup is iffy