Restrict manage users permission

Make the manage users group not be able to add new admins.