Remove promote function from controllers/user.php

— this function allow the user to grant themselves as an administrator.
and is not called by any features. Therefore, I removed it.