Allow admin (reddot) to turn off firewalling when experiment is

swapped out.

tbsetup/swapexp.in

@@ -1324,9 +1324,16 @@ sub CheckFWinfo($)
     # Experiment cannot go from firewalled to not firewalled, in either the
     # swapped or active state.
     if ($wasfirewalled && !$nowfirewalled) {
+	if (! $isadmin) {
 	    $msg = "Not allowed to turn off firewalling!";
 	    goto noway;
 	}
+	if ($curstate eq EXPTSTATE_ACTIVE()) {
+	    $msg = "Not allowed to turn off firewalling while active!";
+	    goto noway;
+	}
+	goto okay;
+    }
 
     #
     # Make sure there is at least one other node besides the firewalled node.