finish mod routes

app/templates/users/user_page.html

@@ -15,10 +15,10 @@
 </fieldset>
 {%- endif -%}
 
-{%- if get_active_user().is_mod() and target_user.id != get_active_user().id -%}
+{%- if get_active_user().is_mod() and target_user.id != get_active_user().id and target_user.permission < get_active_user().permission -%}
 <fieldset class="plank even no-shadow minimal thread-actions">
   <legend>Moderation actions</legend>
-  <form method="POST">
+  <form class="thread-actions" method="POST">
     {{csrf_input() | safe}}
     {%- if target_user.is_guest() -%}
     <input class="warn" type="submit" value="Approve user" formaction="{{url_for('mod.make_user_regular', user_id=target_user.id)}}">