only use role token to determine adminness not the user object

[#55826364]