Make sure :admin can't be set in general create action even w/ credentials