When you log in to a freshly created instance, you aren't currently an administrator. You should be, but it's not clear exactly how we should grant you this power:

• Sync the flag from the upstream in the background?
• Automatically sync the flag when OAuth'ing? (I think this requires upstream changes which don't initially feel great.)
• One-time sync and then the flag lives on instances?

There's a similar issue with disabling an administrating other users:

• Does this happen on the instance, or from the admin console?
• Easier on the instance, but then the initial sync is more magical? Is there any reason not to do it on the instance?
• If it happens on the instance, we need to connect to the instance to bill you, but that's fine.