Repository: jupyterhub/jupyterhub

Issue:
User should not view Token and Admin tabs if not admin anymore
### Bug description

Once an user has been set as admin in the c.Authenticator.admin_users list of helm chart, it keeps admin even the chart is deployed again without its name in c.Authenticator.admin_users. It means that if an user is not admin anymore, JupyterHub local database is not updated and the user remains with admin permission. The only way to remove admin role for an user that is not admin anymore is to enter in Admin tab, click in Edit button and disable admin checkbox.

### How to reproduce

1. Set c.Authenticator.admin_users = {"user1"} in the helm chart;
2. Deploy JupyterHub in a kubernetes cluster;
3. Log in with **user1**, you should view _Admin_ and _Token_ tabs; 
4. Update helm chart to c.Authenticator.admin_users = {"user2"} and deploy helm chart;
5. Log in with **user1**, you continue to view _Admin_ and _Token_ tabs; 

### Personal set up

Kubernetes cluster built using k3d
Helm chart 3.3.7
oauthenticator==16.3.0
jupyterhub==4.1.5


Discussion:
Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! :hugs:
<br>If you haven't done so already, check out [Jupyter's Code of Conduct](https://github.com/jupyter/governance/blob/master/conduct/code_of_conduct.md). Also, please try to follow the issue template as it helps other other community members to contribute more effectively.
![welcome](https://raw.githubusercontent.com/jupyterhub/.github/master/images/welcome.jpg)
You can meet the other [Jovyans](https://jupyter.readthedocs.io/en/latest/community/content-community.html?highlight=jovyan#what-is-a-jovyan) by joining our [Discourse forum](http://discourse.jupyter.org/). There is also an intro thread there where you can stop by and say Hi! :wave:
<br>Welcome to the Jupyter community! :tada:


Resolving patch:
diff --git a/jupyterhub/auth.py b/jupyterhub/auth.py
--- a/jupyterhub/auth.py
+++ b/jupyterhub/auth.py
@@ -102,18 +102,37 @@ def _deprecated_db(self):
 
     admin_users = Set(
         help="""
-        Set of users that will have admin rights on this JupyterHub.
+        Set of users that will be granted admin rights on this JupyterHub.
 
-        Note: As of JupyterHub 2.0,
-        full admin rights should not be required,
-        and more precise permissions can be managed via roles.
+        Note:
+
+            As of JupyterHub 2.0,
+            full admin rights should not be required,
+            and more precise permissions can be managed via roles.
 
-        Admin users have extra privileges:
-         - Use the admin panel to see list of users logged in
-         - Add / remove users in some authenticators
-         - Restart / halt the hub
-         - Start / stop users' single-user servers
-         - Can access each individual users' single-user server (if configured)
+        Caution:
+
+            Adding users to `admin_users` can only *grant* admin rights,
+            removing a username from the admin_users set **DOES NOT** remove admin rights previously granted.
+
+            For an authoritative, restricted set of admins,
+            assign explicit membership of the `admin` *role*::
+            
+                c.JupyterHub.load_roles = [
+                    {
+                        "name": "admin",
+                        "users": ["admin1", "..."],
+                    }
+                ]
+
+        Admin users can take every possible action on behalf of all users,
+        for example:
+
+        - Use the admin panel to see list of users logged in
+        - Add / remove users in some authenticators
+        - Restart / halt the hub
+        - Start / stop users' single-user servers
+        - Can access each individual users' single-user server
 
         Admin access should be treated the same way root access is.
 


Test patch: