Moved authorisation code to admin controller + added missing authorisation code