Moved things around so the userobject and admin flag are stored in request.validated (ValidUser, isAdmin)
fixed a small merge conflict