diff --git a/README.md b/README.md
index 3a0426f..2662a90 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,7 @@ Run the tests locally (against development environment):
 
 ## TODOs
 
+1. Need to actually protect the admin paths with `under()`
 1. Action for resetting passwords
 1. Action for locking/unlocking accounts
 1. CSS