prevent non-admins who are logged in from adding other users