Secure all remaining actions for incidents, and users. Add IsUserAdmin() method to LoggedInUser. Add isAdmin() to Role.