Change flags to a `dict` so they can be serialised

Fix #22
Don't tell normal users that they're not staff or superusers.

No need to rub it in their faces.