Make API banned_by / approved_by mutually exclusive.

This also fixes an API bug where banned_by was always true if you don't
have moderator permission for a thing.