add admin authentication scenarios, tweak devise to disable sign-up, authorize admin to access admin pages