added is_admin property (so that only admins can manage users via API)