[v3.4] #966 fix default user / admin permissions

resolves #966 on `release-v3.4`
fwiw I think one can also legitimately read the `end` as for `case`, not for `when`, but personal preferences aside it's better to follow the near-universal convention, so, agreed.