Add TODOs, change admin auth to use user.IsAdmin func