Auth forces a user to be authenticated before continuing to the route.

MustBeAdmin verifies is an **already authenticated** user is an admin.

UserContext fetches the owner of the request from the current session and and appends it to the request context.