added a test to ensure admin boolean can't be set directly via the controller