switch to require admin auth for new user signup
update seeds
some stubby text for new user awaiting approval
experimental tenant scopes and new active flag