sane default to only grant Super Admin for admins