fix abilities for admin roles