#27: secure backend admin routes against non-authorized requests

match page submit button bug fix