ensure no user can change role id other than super user