basic admin app authentication - API is still wide open