added admin flag & session controller