fix stale auth permisisons

src/middleware/auth.js

@@ -33,10 +33,23 @@ function requireOrganizerOrAdmin(req, res, next) {
 
 function loadUser(req, res, next) {
   if (req.session && req.session.userId) {
+    // Refresh roles from DB on every request to catch admin changes
+    const { Users } = require('../models');
+    const user = Users.findById(req.session.userId);
+    if (!user) {
+      // User was deleted — destroy session
+      return req.session.destroy(() => {
+        res.locals.currentUser = null;
+        next();
+      });
+    }
+    req.session.isAdmin = !!user.is_admin;
+    req.session.isOrganizer = !!user.is_organizer;
+    req.session.displayName = user.display_name || user.username;
     res.locals.currentUser = {
       id: req.session.userId,
       username: req.session.username,
-      displayName: req.session.displayName || req.session.username,
+      displayName: req.session.displayName,
       isAdmin: req.session.isAdmin,
       isOrganizer: req.session.isOrganizer
     };