Only admins should be allowed to create user accounts
At the moment every user can create User Accounts.
Only users with WRITE access to the Administration workspace should be allowed to create user accounts. That is its owner ("admin" by default) and its members (none by default).
@jpn Is this the proper criteria? In DM4 it is slightly different: only users with WRITE access to the "System" workspace are allowed. I don't know anymore why we did it this way.