Restricted the user controller (except the registration actions) to ROLE_ADMIN.  Refactored the responds to be returns and renders.