admin route with basic auth configured via env vars