Thanks for the bug report. This forum is running the latest development branch so there will be some bugs, if you're running 0.8.2 it won't be a problem, or when we release 0.9 it will be fixed
Do I need to call user.isAdministrator on my plugin's admin page?
...or does NodeBB make sure all requests and posts to
You don't have to. NodeBB core makes sure all requests to those routes are from admins.