1. Test vs setting user.admin via web PATCH request -- prevent with user_params in controller
2. Open link in new window
3. Test vs logged-in nav links when not logged in
4. I only found 1 place to use sign_in test helper
5. Unify dupe code in users/new & users/edit
6. Signed-in users can't access new & create
8. Friendly forwarding only once
9. Prevent admin users from destroying themselves