Are you actually using the `is_staff` endpoint? Or did you just copy/paste this from somewhere?