fuck roles, let's just use an admin bit for now
add authorization checking to user/:id route