Fix: only admin can add a new admin.