Securty: only admins can update is_admin

Simply hiding a field from the view does not prevent the user from
modifying the field. This is why mass assignment is such a big problem.