OK, i will try this.
Do I need to call user.isAdministrator on my plugin's admin page?
...or does NodeBB make sure all requests and posts to
You don't have to. NodeBB core makes sure all requests to those routes are from admins.