can't change current_user's role