User permissions can only be changed by admin