R1:71e1911dfcd7

Lock down MetaMTA functionality to administrators

Summary:
We have a debug interface for sending various sorts of email, but normal users
don't really need to use it. In particular, they can:

- Send arbitrary email to other users;
- Discover other users' email addresses fairly easily (CC everyone);
- Send arbitrary email to arbitrary addresses in conjunction with "Mailing
Lists"

In fact, normal users don't need to get to the MetaMTA web interface at all and
it has some somewhat-sensitive things…