Admin can create customers, and can approve/reject site access.

@mikeymurph77, @amZotti - please have a look see.
Instead of whitelisting which controllers/actions should require login, you should set this globally (`ApplicationController`), and blacklist controllers/actions that should *not* be protected. I'd rather be cautious on the side of protecting too much than too little.