Add authorization on admin controller