cleaned up admin controls
added authentication to every controller