restrict non-admin routes
Merge pull request #12 from jluria/cm-admin-privileges

restrict non-admin routes