a valid admin bearer token is required