You state that the admin area requires a login - assuming this is working correctly crawlers should not be able to access those pages and index them.
If a visitor attempts to access a secure URL without authenticating you have a couple of options:
If the resource is a web page, expecting to be accessed by web browsers, you would normally either issue a temporary redirect to a login page, that page would typically be set to
no-imdex and shouldn't cause an issue, ideally this would have a mechanism to return the user to the desired page after they've logged in, or you could issue a
401 - Unauthorized response with the login form in-situ, and again ensure no-index tags are set.
Generally if you're trying to mitigate against bad crawlers, a redirect is likely to be safer, your server won't be returning any other indexable content.
If the resource is on an API, you've got some other options:
If the visitor isn't authenticated, a
401 - Unauthorized is appropriate, if they are authenticated, but don't have rights then a
403 forbidden would be correct.