Adds some missing role checks on admin controller

Some of the admin controller actions are missing an `@authorize` decorator exposing varying levels of personal details about the delegates to any logged in user.