admin app authenticates with API
protect api keys with cookie auth