adding password protection to all of the admin routes, also and env pass now