fixed user security flaw: admin can modify anybody but non-admins cannot