dont allow client to force their own admin flag on