add pwd confirm middleware to admin route