admin endpoints should not be protected