Add figaro to set secret_key_base for dev and heroku prod.
Add gravatar avatar, or provide default if user is not using gravatar.
Set up cascading delete for User=>UserProfile.