refactor to handle admin vs non-admin requests - much better thanks to @krames.