admin should default to false on user creation