Users always have the ROLE_USER role.
Implement Serializable, fix hasRole().
Add identity map, validate(), findCount().
Add edit, list, viewSelf actions, auto-login after registration.
Add /user/list, make /user require login.
Update view templates.