API tokens and assistant keys now have a maximum lifetime, so nothing lives forever by accident.
Deactivating a person now retires the assistant keys they created, so reactivating them doesn't bring old keys back, and lists the API tokens they made so you can review them.
Every data import now requires the right permission, and importing users is limited to Administrators.
