* feat: allow multiple auth sources per user (#500,#477) * only override isAdmin flag if it is provided by the authentication source