admin can toggle user admin privileges