add admin flag to users db and model
add locations admin page; 404 on non-admin access