fix bug in mod and admin check. group is now stored in req.session, not req.user