add Auth.isAdmin(), take out passwd from session