diff --git a/src/Foundation/Yesod/Middleware.hs b/src/Foundation/Yesod/Middleware.hs
index 8e79af686..b78cfb20d 100644
--- a/src/Foundation/Yesod/Middleware.hs
+++ b/src/Foundation/Yesod/Middleware.hs
@@ -138,6 +138,13 @@ yesodMiddleware = cacheControlMiddleware . storeBearerMiddleware . csrfMiddlewar
     normalizeApprootMiddleware :: HandlerFor UniWorX a -> HandlerFor UniWorX a
     normalizeApprootMiddleware handler = maybeT handler $ do
       route <- MaybeT getCurrentRoute
+
+      case route of
+        MetricsR -> mzero
+        HealthR -> mzero
+        InstanceR -> mzero
+        _other -> return ()
+  
       reqHost <- MaybeT $ W.requestHeaderHost <$> waiRequest
       let rApproot = authoritiveApproot route 
       app <- getYesod
diff --git a/src/Handler/Admin/Crontab.hs b/src/Handler/Admin/Crontab.hs
index 09035b3ca..daff2070f 100644
--- a/src/Handler/Admin/Crontab.hs
+++ b/src/Handler/Admin/Crontab.hs
@@ -14,6 +14,9 @@ import Data.Aeson.Encode.Pretty (encodePrettyToTextBuilder')
 import qualified Data.Text as Text
 import qualified Data.Text.Lazy.Builder as Text.Builder
 
+import qualified Data.HashSet as HashSet
+import qualified Data.HashMap.Strict as HashMap
+
 
 deriveJSON defaultOptions
   { constructorTagModifier = camelToPathPiece' 1
@@ -30,33 +33,45 @@ getAdminCrontabR = do
   let mCrontab = mCrontab' <&> _2 %~ filter (hasn't $ _3 . _MatchNone)
 
   selectRep $ do
-    provideRep $
+    provideRep $ do
+      crontabBearer <- runMaybeT . hoist runDB $ do
+        uid <- MaybeT maybeAuthId
+        guardM . lift . existsBy $ UniqueUserGroupMember UserGroupCrontab uid
+
+        encodeBearer =<< bearerToken (HashSet.singleton . Left $ toJSON UserGroupCrontab) Nothing (HashMap.singleton BearerTokenRouteEval $ HashSet.singleton AdminCrontabR) Nothing (Just Nothing) Nothing
+
+      
       siteLayoutMsg MsgMenuAdminCrontab $ do
         setTitleI MsgMenuAdminCrontab
         [whamlet|
           $newline never
-          $maybe (genTime, crontab) <- mCrontab
-            <p>
-              ^{formatTimeW SelFormatDateTime genTime}
-            <table .table .table--striped .table--hover>
-              $forall (job, lExec, match) <- crontab
-                <tr .table__row>
-                  <td .table__td>
-                    $case match
-                      $of MatchAsap
-                        _{MsgCronMatchAsap}
-                      $of MatchNone
-                        _{MsgCronMatchNone}
-                      $of MatchAt t
-                        ^{formatTimeW SelFormatDateTime t}
-                  <td .table__td>
-                    $maybe lT <- lExec
-                      ^{formatTimeW SelFormatDateTime lT}
-                  <td .table__td>
-                    <pre>
+          $maybe t <- crontabBearer
+            <section>
+              <pre .token>
+                #{toPathPiece t}
+          <section>
+            $maybe (genTime, crontab) <- mCrontab
+              <p>
+                ^{formatTimeW SelFormatDateTime genTime}
+              <table .table .table--striped .table--hover>
+                $forall (job, lExec, match) <- crontab
+                  <tr .table__row>
+                    <td .table__td>
+                      $case match
+                        $of MatchAsap
+                          _{MsgCronMatchAsap}
+                        $of MatchNone
+                          _{MsgCronMatchNone}
+                        $of MatchAt t
+                          ^{formatTimeW SelFormatDateTime t}
+                    <td .table__td>
+                      $maybe lT <- lExec
+                        ^{formatTimeW SelFormatDateTime lT}
+                    <td .table__td .json>
                       #{doEnc job}
-          $nothing
-            _{MsgAdminCrontabNotGenerated}
+            $nothing
+              <p .explanation>
+                _{MsgAdminCrontabNotGenerated}
         |]
     provideJson mCrontab'
     provideRep . return . Text.Builder.toLazyText $ doEnc mCrontab'
diff --git a/src/Model/Types/Security.hs b/src/Model/Types/Security.hs
index 480321380..94a4edca5 100644
--- a/src/Model/Types/Security.hs
+++ b/src/Model/Types/Security.hs
@@ -245,16 +245,18 @@ predDNFEntail = over _dnfTerms $ ofoldl' entail Set.empty
 
 
 data UserGroupName
-  = UserGroupMetrics
+  = UserGroupMetrics | UserGroupCrontab
   | UserGroupCustom { userGroupCustomName :: CI Text }
   deriving (Eq, Ord, Read, Show, Generic, Typeable)
   deriving anyclass (Hashable)
 
 instance PathPiece UserGroupName where
   toPathPiece UserGroupMetrics = "metrics"
+  toPathPiece UserGroupCrontab = "crontab"
   toPathPiece (UserGroupCustom t) = CI.original t
   fromPathPiece t = Just $ if
     | "metrics" `ciEq` t -> UserGroupMetrics
+    | "crontab" `ciEq` t -> UserGroupCrontab
     | otherwise          -> UserGroupCustom $ CI.mk t
     where
       ciEq :: Text -> Text -> Bool