added simple admin controller with protection