add distinct 'admin' role separate from 'editors'. Only 'admins' should be able to add/remove editors.