RFP Add admin rights, bugfix in user controller

Since `current_user` is actually available all the time, this one would probably actually be ok as a before_action. I'm ok with leaving it inline like this though if you'd rather.