Ah, great.

I'd like to note that the admin flag does have a special significance here: Accidentally allowing users to raise their project limit or change their group creation flag by using mass-assign and improperly invoking the admin role is magnitudes less of an incident than allowing users to usurp admin rights through the same hole.

So maybe I should remove this PR and instead make one that explicitly adds the is_admin flag into the /users GET api call results.