add asterisk to req fields
require signed-in, admin user for queries for now, fix asterisk