adding more api admin protections