Jwang limit resource access

Check the authentication header of an HTTP request to see if it's from an admin with the correct password. Limit the "shutdown" REST API to be accessed by admin only. 
Done in 7dd96b1.