A couple more places where restrict_superusers needs to be enforced

Each of these checks exists outside of a `DomainMembership`. The only way to be an admin of a domain that restricts superusers is to have an explicit admin domain membership. This will all be tidied up by the upcoming permissions change.