You could just check `req.session.user.isAdmin` in the `all` method and delete `organizer`  if false

To me duplicating this route/code such as the order, etc. seems unnecessary