fix(setup): allow admin creation via arguments

In addition to allowing input via prompt (to hide passwords), we added
support for input via arguments. This way, remote command like on Heroku
will work.

#56
fix(list): require admin permissions to access

Anyone attempting to access the User List page at /user/list without
logging in first or without admin permissions will receive a 403
Forbidden instead.

#61