Add test for forbidden user attribute: admin