config properties using JMap rather than GSON object
restrict access to admin services to configurable allowed admin addresses