code: function (userId, doc, fieldNames, modifier) {
  			// only admins can update user roles via the client
  			return Users.isAdmin(userId) || (doc._id === userId && fieldNames.indexOf("roles") < 0);
  		}
docs: doesn't allow insert or removal of users from untrusted code