code: func isAdmin(w http.ResponseWriter, r *http.Request) bool {
  	log.Debug("validating admin")
  	cookie, err := r.Cookie("scopes")
  	if err == http.ErrNoCookie {
  		writeErrorAuth(w, err)
  		return false
  	}
  	if err != nil {
  		writeErrorInternal(w, err)
  		return false
  	}
  	scopes := strings.Fields(cookie.Value)
  	for _, scope := range scopes {
  		if scope == "admin" {
  			// Confirm the admin permission has not been deleted
  			// since the cookie was created by retrieving the
  			// current value from the DB.
  			cookie, err = r.Cookie("id")
  			if err == http.ErrNoCookie {
  				writeErrorAuth(w, err)
  				return false
  			}
  			if err != nil {
  				writeErrorInternal(w, err)
  				return false
  			}
  			var admin bool
  			q := `SELECT admin FROM users WHERE id=$1`
  			if err = db.Get(&admin, q, cookie.Value); err != nil {
  				writeErrorInternal(w, err)
  				return false
  			}
  			if !admin {
  				writeErrorAuth(w, errors.New("User is not an admin"))
  				return false
  			}
  			log.Debug("validated admin")
  			return true
  		}
  	}
  	writeErrorAuth(w, errors.New("user is not an admin"))
  	return false
  }
docs: // isAdmin ensures that the current user is an admin. We trust the scopes
  // presented by the client because they're validated through HMAC in
  // isLoggedIn().