Disable login for users

There is a need for some users to be allowed to exist within the
system, but who are not allowed to receive tokens, but for whom
tokens may be created. For example, an automated script may need
an auth token, however we do not want to allow a malicious party
to 'take over' the user simply by registering the associated email
address on the OAuth authority.

Change-Id: Iaba9230a35010ef6ee152e8ef4375fe619f37102
Merge "Disable login for users"