I think the inc_header.asp must come after the check of being an admin because that include writes into the browser and the test redirects (will fail after something is written).
The correct code here will be:
%>
<!--#INCLUDE FILE="config.asp"-->
<!--#INCLUDE FILE="inc_func_admin.asp"-->
<%
Call chkAdminOrRedirect()
%>
<!--#INCLUDE FILE="inc_sha256.asp"-->
<!--#INCLUDE FILE="inc_header.asp"-->
<%
Where Call chkAdminOrRedirect() is a generalized replacement for existing authentication control code:
if Session(strCookieURL & "Approval") <> "15916941253" then
scriptname = split(request.servervariables("SCRIPT_NAME"),"/")
Response.Redirect "admin_login.asp?target=" & scriptname(ubound(scriptname))
end if
[edit]removed the "inc_func_common.asp" from includes[/edit]