apiserver/admin: Restrict user logins

Any user login will fail unless that user exists in the environment.
api.Open does not return a NotFound error.