CLC-4005: View-as: for some users, it's possible to add a bCal task

https://jira.ets.berkeley.edu/jira/browse/CLC-4005

:warning: This is only the front-end part, we should also create a PR for disabling the bConnected API endpoints when acting as.
CLC-4009 Block token changes when indirectly authenticated
Merge pull request #2737 from raydavis/qawip

QA CLC-4009 server-side, CLC-4005 client-side