Make Enablement of CA More Intuitive

The CA enablement box is stored away at the bottom of the user page and often overlooked by account owners (moreover, the majority of the time it doesn't work) and the result is that very many users are created without access to CA (despite the clear guidelines we send to account owners). It is very cumbersome to follow up on all new users to ensure that they have the right access. Flag this, e.,g. by asking the account owner "Are you sure this user should not have access to CA?" before they click CREATE or something like that.