added security to admin resources with CSRF support