Redmine

The bulk actions use update_all to change the status which skips callbacks. As a result, the following things do not happen:

- Security notification about an admin being locked/unlocked
- token destruction on lock - this is not that critical since all places that accept tokens do also check if the token owner is active, but it means old tokens come back to life when a user is unlocked.