Add req/res.locals is_admin and is_member

Adjust some permissions