Paranoid security checks.

Check requesting user is locked or deleted, first before checking
is_admin. Deleted or locked user shouldn't be able to log in anyway.

Check we aren't allowing a non-admin user access to a deleted or locked
account. Again, non-admin users can only edit their own entries, and
they shouldn't be able to log in if locked or deleted.

This is more to make it clear what the security requirements are as
opposed to making any changes to security policy.

Change-Id: Iad05f0c94766c42da679c75b45d1c1c9154dd4bf