Securing AccountController
moving call to render flash content to _Layout
(and as a result inlining Account/DetailsPartial into Account/Index)
starting to secure AccountRightsController
simplifying UserEditViewModel
AccountController using anti-forgery token for all posts
add a test for adding/removing user rights