Changes to the backdoor system

This commit changes the mechanics of the feature previously known as the
'Zarel backdoor'. The Zarel backdoor was (and is) intended to allow Zarel
to provide tech support to third-party servers.

It is still easy to opt-out of the backdoor system like before. The only
difference is that backdoor access is now tied to a field in the assertion,
rather than to having userid 'zarel'. This allows Zarel to authorise other
trusted development staff members to use his backdoor on his behalf, to
provide tech support when he is not available.

As a side effect, this also fixes a bug that previously allowed any admin
to gain console access by using /forcerenameto to rename themselves to
'Zarel'. Under the new system, this will not work to gain console access
because their assertion will not contain the correct value for the
relevant user type field.