- Authentication is handled by authsaml2
- First user created must be superadmin
- User admin must be read-only