fixed some routes, added admin auth