fix kiosk restrictions for user switching and logout

it was using authorizeKAction, which means the keys would be "action/logout" while documentation
clearly states it is just "logout". that is now fixed, including keeping support for "action/logout"
so as not to break existing configurations.

switch_user simply wasn't being checked at all, now it is.