add route, fix auth allow, move admin to modules