Some admin-security fixes. Non-admins shouldn't be able to promote them self etc.