Mass Assignment — Self-Promote to Admin

QuickStart's signup form takes the new user's data as JSON and copies every field into the User record. The form normally only sends username/email/password — but the backend has no field whitelist. Become admin at signup.