admin flag accessible to admins

Setting the api flag in the /users POST / PUT api is already possible. This PR adds the is_admin flag to the attributes accessible to admins so it can also be fetched via the /users GET api.