Remove superuser field for non-superusers

If an admin user has permission to manage other users, they are
able to set others as superuser, or even create their own
superuser account. That's not really what we want.

modules/backend/controllers/Users.php

@@ -94,6 +94,10 @@ class Users extends Controller
             return;
         }
 
+        if (!$this->user->isSuperUser()) {
+            $form->removeField('permissions[superuser]');
+        }
+
         /*
          * Add permissions tab
          */