Fixed authentication for admin routes