Side-issue: do we know for a fact that normal users can't edit their profile? Should we maybe save who the admin is in a safer (our own ) collection?