don't send the disabled flag - we only send enabled entities anyway
Respect the specified project when listing
secure the configuration api if it's likely that all requests will have to be authenticated, also allow extension of the configuration properties
Unbreak an extension point - oops
Add telephone field to accounts
set an ISO date format that's easier to parse
correct auth message
don't return disabled users in the xml feed
Set the last login time for all login types