Enforce low authbypass admin checks

[r1kka6]

Summary

• require an authenticated admin session before rendering the low Authorisation Bypass page
• enforce the same low-level admin check on both user-data and user-update endpoints
• return HTTP 403 for denied page and API requests so direct calls do not bypass the UI guard

Verification

• php -l passed for source/low.php, get_user_data.php, and change_user_details.php
• vulnerable baseline lets a gordonb session read the full user list and POST {"id":1,...} with {"result":"ok"}
• patched runtime returns 403 for the gordonb page, GET API, and POST API while an admin session still receives the user list