CHANGED: login returns is_staff now