Regular user can modify admin permissions and password

I find the entire user permission system backwards. You have to restrict a user to give access
see post