user: allow admins to assign admins