* block add user with group_id < logged in user group_id
* fix add user password hash