allow search for birthday from-to, limit considered search fields if limited permissions
simple endpoints for GET pkg/flag/opt incl. admin flags, with a visibility setting that defaults to invisible. This endpoint should be available with any audience as long as a personal token is provided