require login for admins api