added logic and a test to ensure the admin attribute cannot be updated through the website