DO NOT MERGE: disabling user accounts MVP

MVP functionality to disable disruptive users:
1) Creates a UserStanding model, which is checked against each time a user logs in (if the user's account_status is disabled, they can't get in and they get an error message saying their account has been disabled)

2) Deletes all of that user's sessions, so whenever they navigate to another page they will be redirected to the login page.

The template is very, very barebones, and right now the url isn't linked to anywhere. That can easily be changed by adding a link to the instruct dashboard tab. Alternatively, this functionality can be directly inserted into the instructor dashboard.

@nedbat 
@e0d