added auth to admin post route