Added non-django way to make a webuser superuser or staff member.

I think we actually shouldn't expose `is_staff` as an editable field. the whole point of this PR is to prevent ever having to make non developers staff, so if they can give anyone staff access that kind of defeats the purpose. sorry this wasn't clear earlier.