Appeals court: Trump can halt refugee admissions but must serve those already here