User admin rights

capybara is ambiguous on which button to click, update admin path isn't right yet
I think that you shouldn't allow params at all here.  My thought is that posting to `update` should just toggle the user's admin flag.