add "impersonate" capability to admin key