A stricter safety net around who can reach admin actions

The automated check that makes sure every protected part of the site actually declares its protection is now much harder to fool. It reads the real code rather than the surrounding prose, so a route can describe what it does in plain English without confusing the check, and a gap can no longer hide behind a comment.