Fix role admin.
Also look for token from cookie.