apiserver/admin: Restrict user logins

Any user login will fail unless that user exists in the environment.
Do you think we should satisfy that it is a Not found error?