bugfix: exclude flags on non-admin user update
fix some view/edit privileges