security fixes, require admin login access to important pages