anchor.diff:            case chef_db:count_user_admins(DbContext) > 1 of
               %% They are an admin, are they attempting to change the admin status?
               false ->
  -                case ej:get({<<"admin">>}, UserData) of
  +                case RequestedAdminFlag of
                    %% They are attempting to de-admin as the last admin, deny
                    false ->
                      forbidden;
  
positive.code:   UserName = chef_wm_util:object_name(user, Req),
    case wrq:method(Req) of
      'PUT' ->
        %% Ensure user can't reset themselves to not be non-admin if none are left
        case chef_wm_authz:is_admin(Requestor) andalso chef_wm_authz:is_requesting_node(Requestor, UserName) of
          true ->
  
negative.code:           end;
          false ->
            %% User is not in danger of setting last to non-admin status
            %% However, now we need to check that normal users cannot admin themselves
            case RequestedAdminFlag of
              true ->
                %% Only admins can admin others
                case chef_wm_authz:is_admin(Requestor) of
                    true  -> authorized;
                    false -> forbidden
                end;
              _ ->
                %% We are not trying to escalate privs, pass on as normal
                chef_wm_authz:allow_admin_or_requesting_node(Requestor, UserName)
            end
        end;
      'GET' ->
        chef_wm_authz:allow_admin_or_requesting_node(Requestor, UserName);
  