I'd have to doublecheck on exactly what the `opscode-account` code does with user records, but this blacklist will allow users to store **ANYTHING** they'd like in the user record. I don't find this to be particularly friendly to our API. Perhaps, instead, we should implement a whitelist of data that can be stored in the serialized object.