added express middleware; isadmin logic on the front end