fixed auth middleware on server product controller

only admin user can now make changes on products - add, delete, update