admin can modify/add the role attribute of a user
rights of users handled well