Jwang limit resource access

Check the authentication header of an HTTP request to see if it's from an admin with the correct password. Limit the "shutdown" REST API to be accessed by admin only. 
I'm not wild about this API call. Is it guaranteed that everyone who has the right to restart the server has the right to read the SSL key and the database password? I don't think so...