protect admin controllers w/ httpbasic; override RESTful routes for voting