#4 add ROLE_CONTAINER_ADMIN for GAE UserService.isAdmin()