[improve] User.isAdmin(). User.virtual('password') handling token