administrators can update another user's role