Address audit findings across calendar, mail, store, suite_core and utils

Fixed privilege escalation to site takeover in admin member endpoints that accepted caller-supplied User names without permission checks.