admin can subtract points and remove badge if hardcoded into controller