factor out (haz-admin) from core.clj to auth.clj