closed #13
users can only assign the rights they himself have