Depends on D19606. Ref T13189. See PHI642.

• Disabling/enabling users no longer requires admin. Now, you just need "Can Disable Users".
• Update the UI to appropriately show the action in black or grey depending on what clicking the button will do.
• For "Approve/Disapprove", fix a couple bugs, then let them go through without respect for "Can Disable Users". This is conceptually a different action, even though it ultimately sets the "Disabled" flag.

• Disabled/enabled users from the web UI as various users, including a non-administrator with "Can Disable Users".
• Hit permissions errors from the web UI as various users, including an administrator without "Can Disable Users".
• Saw the "Disable/Enable" action activate properly based on whether clicking the button would actually work.
• Disapproved a user without "Can Disable Users" permission, tried to re-disapprove a user.
• Approved a user, tried to reapprove a user.