1. IP (range) lock down
2. brute force protection (X attempts from same IP per Y minutes)
3. email confirmation (should contain only the logic, requires an email field in a project module)
4. timezone / language settings
5. separators (also CSV) settings
6. date/time format settings

Each feature should be configurable (config module) and should have the option to be locked down for admins (non owner). This should also be extended to changing username and password.

It seems logical to add a user/settings action that allows changing these. Questionable though whether these fields should be available in edit/item action (see password)... though this may be handy for admins editing the user, i.e. admins use edit/item whereas user use user/settings and user/password.