Fixed some bugs with subject validation.

Admin permissions can be changed only by admins, not by the owner.
check_user_is_admin should supports cross-tenant admins (for public-volumes in the future).
Fixed some duplicates in code.

Change-Id: Id891de02b2e45be3d1090d4192856d97c1481abe