Review User Admin Security

[dandavies99]

Form fields are currently disabled in CustomUserAdmin to prevent escalation of privileges and enforce the use of groups to manage permissions. This appears to be recommended but may not protect against users generating requests via means other than the browser.

Once we have a minimum viable product, we should revisit this to see if there is a way to block such requests being acted on.

[cc-a]

A more robust answer may be provided by the has_*_permission hooks provided by ModelAdmin:
https://docs.djangoproject.com/en/2.1/ref/contrib/admin/#django.contrib.admin.ModelAdmin.has_view_permission

Or for instance level permissions could Guardian be applied to the User model?