User auth fixes

* Restore access to "*" channel for users with universal privileges
* User.CanSeeChannel should not return true simply because channel=="*"
* Removed unused AnyChannels methods from User
* Added more User unit tests.
* Refuse even a valid session cookie from a user whose Disabled=true