A few fixes in SpecialUserFuncs: made avatars have a +30-day expiry date and made full login form show encryption blurb even when user_level > USER_LEVEL_MEMBER. Added expanding user-info blocks in memberlist (experimental).
Fixed System pages not being createable even with proper admin rights. This is hackish, it probably needs to have something implemented at the ACL level.
SECURITY: Full query is no longer shown on SQL injection attempt; silenced calls to mysql_unbuffered_query() due to some untraceable yet harmless errors