fixed web initiated reload
added security advice on /api/admin