fix bug in the installer

where a malicious user could create a new admin user.