allowed is_staff and is_superuser to be retrieved from the server