I don't think its a good idea to be able to set the admin flag via mass-assignment. This will make the system a lot more insecure.