Allow disabling remote user access

Currently TLS certificates can be used by the client indefinitely, but the server administrator should have a way to disable remote user access.

Consider adding a `user update --remote-disable` boolean option as a global toggle, and/or `invite update <id> --disable` to control access at the invite level. Either operation would revoke the client cert.