Admin can create customers, and can approve/reject site access.

@mikeymurph77, @amZotti - please have a look see.
Ok, so adding the require login before action to most/all of the controllers will take care of your first comment?