Segurança
- Restricted the default registration fields AJAX save action to authorized administrators and valid field posts.
- Added per-item permission checks to registration field and user approval bulk actions.
- Removed approval and disapproval by email GET links; administrators now use the protected actions on the Users page.
- Blocked direct web access to registration uploads and added authenticated, ownership-checked downloads.