Specs for admin-protected requests.