Merge branch 'master' into clostridium

* master:
  Need to wait for currentUser promise
  Tweak custom session
  Keep non-admins out of user profiles

app/pods/protected/users/changepassword/controller.js

@@ -16,6 +16,7 @@ export default Ember.Controller.extend({
       let options = {
         method: 'POST',
         data: {
+          id: this.get('session.currentUser.id'),
           password: this.get('password'),
         },
       };

app/pods/protected/users/show/route.js

@@ -1,6 +1,17 @@
 import Ember from 'ember';
 
 export default Ember.Route.extend({
+  beforeModel: function(transition) {
+    this._super(transition);
+
+    this.get('session.currentUser').then((currentUser) => {
+      let user_id = transition.params['protected.users.show'].user_id;
+      if (!currentUser.get('isAdmin') && currentUser.get('id') !== user_id) {
+        this.transitionTo('protected.users.index');
+      }
+    })
+  },
+
   model: function(params) {
     return this.store.findRecord('user', params.user_id, { reload: true });
   },