Removed ability for non-admin to make themselves admin

When non-admins are changing their role, instead of posting one of the role ids available on the page, they can post the role id of admin role - this assigns them an admin role.

Added a check not to allow non-admins to assign admin roles.
Fixed cancel_subscription

Current stripe api doesn’t have a **subscription.status**, it resides
in **customer.subscriptions.data**. Just cancel the first one, since
there should only ever be one.
Merge pull request #98 from joshlarsen/master

Fixed cancel_subscription
Merge pull request #90 from edgi/master

Removed ability for non-admin to make themselves admin
merged upstream changes