Every user with a role greater than domain admin should not be accessible to a domain admin.

see #394