add user feature cleanup: only allow admin/super-users to change User Type and assign to System Groups