Destroy sessions for users when they're deactivated.
UI for inspecting and re-activating deactivated users.

This includes one possibly breaking change: the notify_password_reset method on
User objects is now expected to return the message that would be flash()ed to
the user, rather than flashing it itself.

When users are deactivated, they go to the "Deactivated users" screen, and the
only other action possible for them is for them to be reactivated. Only users
who have a role at their level or higher can reactivate them.

While I was in the area, added more breadcrumbs to keep navigation consistent.