Reworked admin routes and auth-handling filters (purging the cross() helper)