Admin user branch lockout

[cbrladmin]

Admin users should only be able to view and control both sessions and clients of their assigned location only. Currently this is not a good approach since any admin user can control both devices and sessions of any location.
This will prevent accidents

[sekjal]

The first challenge of this would be associating users with Locations; this would need to be an N-M relationship, as we'd want staff to be able to work at multiple Locations, and it would need to respect Location hierarchy without having to specify each descendant Location. We'd also need to be able to map SIP and LDAP attributes to Locations within Libki so that users authenticating that way do not need to be manually set.

[cbrladmin]

@sekjal For now, I think it is better to keep it simple.

From a staff account perspective:
Mapping SIP and LDAP attributes to Locations are not really necessary now. Local Admin accounts that we create in LibKi should be more like a local staff account that is primarily to be used for managing clients and patron sessions of a particular location and its descendant. This local admin account credential can be shared among staff of particular location.
In our case, we currently have a release terminal (accessible only to staff) in all locations for print jobs. We can use the same release terminal for staff to manage kiosk computers as well. The username and password for various applications are saved in a password manager.

From a patron perspective
Nothing changes. No change in SIP & LDAP is necessary. Patron should be able to access our kiosk computers from any location using their card number & pin.