Locked domains are not allowed to change any of these things, so
it is best not to display them.
Previously, the account submenu view handled a fourth argument for
whether the tab is active. This behavior dates back to
842a476f54, when a fourth argument
was never passed. A fourth argument was eventually passed in
b1c0a2ede7, but it hasn't been needed
since a4a563b49b, when the /account
path was redirected to /account/multifactor-manage.
This changes the fourth argument to be a flag, which if set, does
not display the tab.
db0df0ff6c