Extra permission

I agree that the permissions could use some work to allow for more delegation of user management. Currently, only users with 'administer users' permission can use userplus.

Here is what I'm thinking:

1. Users with 'administer users' permission will always be able to use everything in userplus
2. There will be separate permissions for:
   • adding multiple users
   • assigning roles
   • assigning users into organic groups
   • administering userplus settings (to separately secure the page at admin/settings/userplus)

My main concern is that I don't want to open up too many security holes, but I think that administrators are going to be able to figure out how to secure their sites properly with these new permissions in place.

We may want to allow either the user with 'administer userplus settings' rights to exclude some roles from the role assignment screen, but that's probably a follow-on issue.

The proposal in comment #1 has been checked in and should be available shortly in the 6.x-2.x-dev snapshot.