search criteria now include birthday_from and birthday_to (for use by onsite regdesk)
separate GET endpoints for flags, packages, options with expanded visibility configuration. These endpoints permit tokens with a different audience (for use by 3rd party systems). This also gives limited readability for admin-only flags such as "guest", "staff", "director", if configured on the flag.
This PR adds two new features to the API: