Jwang limit resource access

Check the authentication header of an HTTP request to see if it's from an admin with the correct password. Limit the "shutdown" REST API to be accessed by admin only. 
It looks like you didn't actually add this parameter?