Don't allow non-admins to even generate admin cookies.

They weren't usable due to the checks in reddit_base, but it's safer to
not even generate 'em.

Thanks to /u/largenocream for reporting this.

r2/r2/controllers/api.py

@@ -3303,6 +3303,9 @@ class ApiController(RedditController, OAuth2ResourceController):
                    remember=VBoolean("remember"),
                    dest=VDestination())
     def POST_adminon(self, form, jquery, remember, dest):
+        if c.user.name not in g.admins:
+            self.abort403()
+
         if form.has_errors('password', errors.WRONG_PASSWORD):
             return