apiserver/admin: Restrict user logins

Any user login will fail unless that user exists in the environment.
After chatting, this should be `permission denied` or whatever error string we get from that common error.