More fine grained validation for staff register

[exploide]

Since c70673b we protect the views against data injection via manual POST requests. Even when submission was disabled in a settings object, the view did not check that.

This is fine for students and workshops but stuff is a bit more complicated. We should check different tutor, orga, helper fields and match against settings attributes.

[ckleemann]

It is a good idea to write a testcase for this issue first. At the moment I am not sure if this problem relay exists.

[exploide]

For workshop submission, it was definitely there. In case of staff registration it might be the case that the dynamic form field fiddling already protects against this.