protect /admin with sessionAuth