Handle sub-users better, closes #340

Fixes bugs in the system as well as fixes security holes.