Prevent signups via /auth/signup with closed registrations

Previously, there was no check in place on the web-based /auth/signup
endpoint to ensure users can't still be created while registrations are
closed.

Fixes #1649