[#80256282] Restricts access to /user route if not admin

- Comments out rest: false in user controller config (was restricting
access to /user)
- Modifies platformStaff policy to check if admin without .hasRole
- Sets isAdmin property in session controller to use check in policy
- Removes trailing spaces throughout