Prevent users becoming someone they shouldn't be

This was previously only enforced by gating the frontend component, this PR
tidies things up by making sure the backend prevent it happening as well