restricts access to manipulating users in views and controller
adds user behavior toggle with contextual status and links