verifyUser account for session checking
session checking for admin department level

* add
* update
* delete
locked up REST functions for admin

* isAdmin, isEditor, isPoster methods for verifying users are who they
need to be to update things
* added checking in all operations (that need it) in admin controller