add loadUser middleware for routes and include this to check for admin role and show private layers