Block disabled admins from admin endpoints

Disabled Mail Admins or System Managers with valid sessions or API keys could restore their own access by calling enable_members without involving another admin; the fix scopes the override to logged-in users only.