Add isSuperUser flag on GET /authenticate