implementing serverside authorization
protecting admin pages on the client (pre-refactor)
protecting admin pages on the client (post-refactor)