admin login, XSS protection, bs 3.1.1, admin ACL::ALLOW