core: Refactor authorization in admin controllers. Should fix #782