add security to admin route