test posting new admin requires admin permission