added admin-protected getCard route to parse