added auth restriction to admin