authenticate hospital admin before CRUD-ing patients or surgeries