status only editable by admin; restricted user access from /user