admins can only add/remove badges.