Session: don't strip is_admin from $user object