Change API to only allow admins