Turns one of the caller's own subscriptions on or off. This replaces
unsubscribing by deletion: a disabled subscription receives no new
notifications, but the subscription and the notifications already
posted to it are kept, so the user's in-app and email history is
preserved and the subscription can be re-enabled later.

A subscription that doesn't exist and one that belongs to another
user both return 404, so the route can't be used to probe which
subscription ids exist.