Make admin

Handle head node bootstrapping differently. Break it down so that we can give the node admin privilege before chef-client, so we avoid the nasty failure and manual intervention previously always required for first head node.