Make sure the User.admin attribute is not accessible
Open the Gravatar "change" link in a new window
Make sure navigation links do not appear for non-signed-in users
Refactor the 'new' and 'edit' user views to remove duplication
Redirect signed-in users to root when they try to create a user
Make sure that the friendly forwarding only forwards to the given URI the first time
Prevent admin users from destroying themselves