fixes #2281 - don't allow admin flag to be removed from admin account