admin can update heself, commom user can't; admin can update other user's role, but he can't udpate heself