Allow specification of ad hoc admins

This change was required following the need to manage different groups of admin users - some cleared for accessing only certain machines in our pipeline.