Sort of ACL stuff, hacked in. You must be an admin to modify/add users or roles, but you can modify some of your own information