require admin privs on all admin routes

app/controllers/admin.js

@@ -29,9 +29,14 @@ export default class AdminController extends SiteController {
   }
 
   async start ( ) {
+    const { session: sessionService } = this.dtp.services;
+
     const router = express.Router();
     this.dtp.app.use('/admin', router);
 
+    const authRequired = sessionService.authCheckMiddleware({ requireLogin: true, requireAdmin: true });
+    router.use(authRequired);
+
     router.use('/user', await this.loadChild(path.join(__dirname, 'admin', 'user.js')));
 
     router.get(