Architectural question

[eluser]dmorin[/eluser]
Apparently, you've managed to implement the "Authentication" portion (who are you) of a login system and now you need the "Authorization" component (what can you do). So the question becomes, how are you storing who is an authorized admin and who is not? Is this being added to the session? If not, it should be.

The next issue I see is that you're mixing multiple concepts in one controller. What is an "Admin" class? It sounds like a class for managing the backend of the application in which case it isn't related to the login system and the two should be in different classes/controllers. Once you do this, you can add checks for the is_logged_in and is_admin (whatever you're naming them) session variables to the construct of your "admin" class to protect all of the methods within it.

Hope that makes sense. Also note that a good login system is difficult to implement and if this will be a public website, you may want to look at the systems other people have created. Just search on the wiki. Good luck.