update docs regarding req.user.account_level