load g.user/is_manager during load_user, not during login

that was a mistake: login happens once, load_user on every request
indexing: use get_document() defined on service object: it ensures all objects have a value for allowed_roles_and_users