Switch middleware order to result in proper error

fixes #3694

- Split the res.isAdmin check out into it's own thing because we need to detect whether we are in the admin, before everything else

cc @hswolff