Protect all admin actions with before_action.