accounts: display is_staff and make it editable

This will be used to select user that are allowed to update ruleset.
rules: only staff member can do change

A normal user is read-only. Only a staff member can do changes on
the existing objects.

This patch is add a permission check to all concerned views. Next
patch will suppress access to the views.
rules: no link to edit for non staff
accounts: don't allow normal user to change username
suricata: non staff can not edit