- 403 for non-admin user (is_admin=false in DB) - next() called for admin user (is_admin=true in DB) - 403 when no user on context (no DB query) - 403 when context user spoofs isAdmin=true but DB has is_admin=false (T-10-04)
