restrict challenge pages to admins until challenge; cleanup unused routes; fix roles; remove unneeded res.json calls

can activate challenge in static/js/common.js