Lea user can edit or disable account

Accounts cannot be deleted once created, but may be deactivated. When an account is deactivated, the account_enabled flag for that user is set to false, the user is logged out, and is not allowed to log back in. 

Modified sessions controller to verify account_enabled status before calling sign_in.

Extracted user form into a user_info partial, and hid the password field if the form is being used for editing an existing user, since the form will pass nil if the user doesn't want to change their password, and we can't pass the actual password. Changing the password will be a separate task. 

Created a separate params method for editing, since the password params won't be sent to the controller by the form.
Since this doesn't really destroy the user, should I create a custom route and method for the purpose of disabling users, rather than using the "destroy" method for something other than destroying?