BUGFIX: set $scope.user so admin states show action buttons
add auth token to WorkerSerializer, but restrict all access to WorkerList and WorkerDetail to admins
BUGFIX: comparison operator should be an assignment