improve demo data permissions

Also deny changing administrator password through the "my account" page.