MDL-42883 Administration: Check sessionkey before taking action on user profile fields
MDL-42643 course: Member in same group should only loginas

If course groupmode is set to SEPARATEGROUPS, and user doesn't have
site:accessallgroups capability than only allow user to loginas if
current user is in same group as loginas user