Admin access only — unauthorized attempts are logged