Allow a cso_admin to create any user except an admin.