We can now upgrade pending users

Also introduced User.requireAdmin(), to support security.