add require_api_token to admin routes