must login first
first user will be auto created
user can't modify his role, admin can only update role for others