factor out ownuser on auth middlwr
factor in 'isAdmin' flag on auth middlwr