exclude superadmins from security