RFR - added admin functionality

I would add at lease one test to make sure a regular user can't access the methods in this controller