split to admin and account. admin can operate all APIs; account cannot
operate createAccount/deleteAccount