Don't allow non-admins to even generate admin cookies.

They weren't usable due to the checks in reddit_base, but it's safer to
not even generate 'em.

Thanks to /u/largenocream for reporting this.
Fix vulnerabilities in setting friend and ban notes.

Thanks to /u/largenocream for reporting this.