refactor, add admin route, sql-function for auth checking