Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/contact/api/engine/manage_contact.php

@@ -20,6 +20,7 @@
         $errors = $uploader->upload('contact_image');
         if (!empty($errors)) {
             $answer['success'] = 0;
+            http_response_code(400);
             $answer['message'] = $errors[0];
             exit(json_encode($answer));
         }