add cookie pass and a note about not commiting config file
move all paths under /admin