Right now only create and destroy actions are accessible to admins, aren't they? Then it might be a good idea to add:

disable_default_routes