adding some security tests and ensuring that user admin field can't be mass assigned