ROLE_ADMIN can now promote users to ROLE_MODERATOR and back to ROLE_USER