Administrator copies all grants to locked fields
include id for user's json
use accessor's to set definitions
Add endpoint for logging out via deleting session