At some point, Leaders were given the ability to reset passwords. But
the permissions were always intended to be scoped to the Admin
position which requires a working 2FA setting.
The website API now reports userid '0' as an unregistered user.
Apparently PHP treats the string '0' as falsy. In the interests of
not overhauling literally all our APIs, I've decided to only change
the code in the website API. The rest doesn't need to be changed
because number-only userids haven't been allowed for a very long
time.
Fixes https://github.com/smogon/pokemon-showdown/pull/7704
Closes#1567
The main reason I'm not simply merging Annika's PR is because this
way makes it clearer that I'm taking responsibility for all this
code, that it's mostly code I wrote, and also because it makes it
easier to ensure that none of the files have been changed.
(Not that I don't personally trust Annika, but I have something
resembling an obligation to users not to expose them to risks based
on personal trust.)
