Is verifying whether a user is an admin based on req.user secure? Is verifying whether a user is an admin based on req.user secure? express express