Lea user can edit or disable account

Accounts cannot be deleted once created, but may be deactivated. When an account is deactivated, the account_enabled flag for that user is set to false, the user is logged out, and is not allowed to log back in. 

Modified the sessions controller to verify the account_enabled status before calling sign_in.

Extracted user form into a user_info partial, and hid the password field if the form is being used for editing an existing user, since the form will pass nil if the user doesn't want to change their password, and we can't pass the actual password. Changing the password will be a separate task. 

Created a separate params method for editing users, since nil is sent for the password params during edits.
how about just putting an `only` on the originial before action?