add permission layer for admins for backend API

Fix for dashboard#51 (closed)

Protect dashboard backend with permission layer (we will use decorators for that)

We should define what endpoints should be available only for admins.