The route had a redundant isAuthed() checking for 'bpb_admin' cookie,
but login sets 'admin_token'. The middleware already guards all
/api/admin/* routes, so the in-route check was just wrong.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>