extract user factory
require admin permission to edit users
change auth-debug view url
friendly 403 html page