add admin authorization to destructive actions