added csrf protection for admin end-points