Form-from-model clarifications
Set user-protecting headers (decorator for now); see #4