Protect routes and require admin user group. Working on #41