[#356] Tweak auth.create_user logic

If ckan.auth.create_user = False then don't let anyone create users,
either via the API or via the web interface.
[#356] Better error messages for create user auth

If not allowed to create users via api then say 'not authorized to
create user via api', if not allowed to create users at all then say
'not authorized to create users'.