move route middleware checking into session manager hooks
move isAdmin checking into helper.authorize
hide the user items when user got banned