add a way to disable a user's account

[cdepillabout]

It would be nice to have a way for the upstream web app disable a user's account.

This should ideally be implemented by a JSON endpoint on goat-guardian that is accessible by the upstream web app but NOT accessible by the end user.

This is related to #9, but instead of fully deleting ALL the user's information, it just renders the user unable to login.

A similar endpoint to re-enable a user would be helpful.

A command line application that gives the operator a way to disable/re-enable a user would be helpful as well, although maybe out of scope for this issue and the initial implementation.