added route protection to admin and reservations controller