Add a nonce on the account edit screen
Only pass the user object to post_save on accounts
Flesh out the readme, full of typos probably