Global users

I think this is finally ready for master. It's now be backwards-compatible with current master. Only potential diff is that ApplicationController#session now respects Agency.current.

Any objections?