Fix AccountSettingsView to only try to change permissions in development

app/views/account/AccountSettingsView.coffee

@@ -265,12 +265,11 @@ module.exports = class AccountSettingsView extends CocoView
 
     permissions = []
 
-    adminCheckbox = @$el.find('#admin')
-    if adminCheckbox.length
-      permissions.push 'admin' if adminCheckbox.prop('checked')
-
-    godmodeCheckbox = @$el.find('#godmode')
-    if godmodeCheckbox.length
-      permissions.push 'godmode' if godmodeCheckbox.prop('checked')
-
-    me.set('permissions', permissions)
+    unless application.isProduction()
+      adminCheckbox = @$el.find('#admin')
+      if adminCheckbox.length
+        permissions.push 'admin' if adminCheckbox.prop('checked')
+      godmodeCheckbox = @$el.find('#godmode')
+      if godmodeCheckbox.length
+        permissions.push 'godmode' if godmodeCheckbox.prop('checked')
+      me.set('permissions', permissions)

server/users/user_handler.coffee

@@ -39,7 +39,7 @@ UserHandler = class UserHandler extends Handler
 
   getEditableProperties: (req, document) ->
     props = super req, document
-    props.push 'permissions' unless config.isProduction
+    props.push 'permissions' unless config.isProduction or global.testing
     props.push 'jobProfileApproved', 'jobProfileNotes','jobProfileApprovedDate' if req.user.isAdmin()  # Admins naturally edit these
     props.push @privateProperties... if req.user.isAdmin()  # Admins are mad with power
     props

spec/server/functional/user.spec.coffee

@@ -1,6 +1,5 @@
 require '../common'
-User = require '../../../server/users/User'
-
+utils = require '../utils'
 urlUser = '/db/user'
 
 
@@ -154,6 +153,13 @@ describe 'PUT /db/user', ->
       form.append('_id', joe.id)
       form.append('email', 'farghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlar
 ghlfarghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlarghlfarghlarghl')
+      
+  it 'does not allow normals to edit their permissions', utils.wrap (done) ->
+    user = yield utils.initUser()
+    yield utils.loginUser(user)
+    [res, body] = yield request.putAsync { uri: getURL('/db/user/'+user.id), json: { permissions: ['admin'] }}
+    expect(_.contains(body.permissions, 'admin')).toBe(false)
+    done()
 
   it 'logs in as admin', (done) ->
     loginAdmin -> done()