Trainer-to-manager escalation via session-flag bypass

Privilege escalation in wger before 2.6 allows remote authenticated users with trainer access to impersonate a gym manager. The trainer-login view uses an AND condition that accepts a stored trainer.identity session flag instead of rechecking the acting user's trainer permission, while its target-role block runs only when the current user remains a trainer. After a legitimate switch to a regular user, the same session can switch again to a manager in that gym, exposing member data and permitting contract and configuration changes.