disallow certain actions in demo mode

* Cannot change password
* Cannot delete user
* Cannot migrate domain or change plan

Fixes #20

src/routes/user.js

@@ -127,6 +127,7 @@ function remove(req, res, next) {
     if (req.user.id === req.params.userId) return next(new HttpError(403, 'Not allowed to remove yourself.'));
 
     user.remove(req.params.userId, auditSource(req), function (error) {
+        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
         if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
         if (error) return next(new HttpError(500, error));