Fix session.canAdminUser using req.user. And login user on create