privileges: allow revoking of administrator privileges