removed: not testing if item in session would be None
added: auth required for admin pages