#3 update user creates token if not present (migrate for old users)
#3 #9 Admin can give other users admin access