add comment about req.user.account_level