diff --git a/.travis.yml b/.travis.yml
index 168469fd0d..6903b03386 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -26,4 +26,5 @@ node_js:
     - "4"
 branches:
     only:
-        - master
\ No newline at end of file
+        - master
+        - develop
\ No newline at end of file
diff --git a/src/plugins/install.js b/src/plugins/install.js
index c9b57909c9..9638dbc0dd 100644
--- a/src/plugins/install.js
+++ b/src/plugins/install.js
@@ -89,8 +89,7 @@ module.exports = function (Plugins) {
 				next();
 			},
 			function (next) {
-				var command = installed ? ('npm uninstall ' + id) : ('npm install ' + id + '@' + (version || 'latest'));
-				runNpmCommand(command, next);
+				runNpmCommand(type, id, version || 'latest', next);
 			},
 			function (next) {
 				Plugins.get(id, next);
@@ -102,12 +101,13 @@ module.exports = function (Plugins) {
 		], callback);
 	}
 
-	function runNpmCommand(command, callback) {
-		require('child_process').exec(command, function (err, stdout) {
+	function runNpmCommand(command, pkgName, version, callback) {
+		require('child_process').execFile('npm', [command, pkgName + (command === 'install' ? '@' + version : '')], function (err, stdout) {
 			if (err) {
 				return callback(err);
 			}
-			winston.verbose('[plugins] ' + stdout);
+
+			winston.verbose('[plugins/' + command + '] ' + stdout);
 			callback();
 		 });
 	}
@@ -119,9 +119,7 @@ module.exports = function (Plugins) {
 
 	function upgrade(id, version, callback) {
 		async.waterfall([
-			function (next) {
-				runNpmCommand('npm install ' + id + '@' + (version || 'latest'), next);
-			},
+			async.apply(runNpmCommand, 'install', id, version || 'latest'),
 			function (next) {
 				Plugins.isActive(id, next);
 			},
diff --git a/src/routes/index.js b/src/routes/index.js
index f71eac2c62..b3bc508c7d 100644
--- a/src/routes/index.js
+++ b/src/routes/index.js
@@ -149,7 +149,7 @@ module.exports = function (app, middleware, hotswapIds) {
 	app.use(relativePath, express.static(path.join(__dirname, '../../', 'public'), {
 		maxAge: app.enabled('cache') ? 5184000000 : 0
 	}));
-	app.use('/vendor/jquery/timeago/locales', middleware.processTimeagoLocales);
+	app.use(relativePath + '/vendor/jquery/timeago/locales', middleware.processTimeagoLocales);
 	app.use(controllers.handle404);
 	app.use(controllers.handleURIErrors);
 	app.use(controllers.handleErrors);
diff --git a/src/socket.io/admin/user.js b/src/socket.io/admin/user.js
index 272a13f7f7..480ad6a4d5 100644
--- a/src/socket.io/admin/user.js
+++ b/src/socket.io/admin/user.js
@@ -8,6 +8,7 @@ var groups = require('../../groups');
 var user = require('../../user');
 var events = require('../../events');
 var meta = require('../../meta');
+var plugins = require('../../plugins');
 
 var User = {};
 
@@ -169,6 +170,13 @@ function deleteUsers(socket, uids, method, callback) {
 					uid: socket.uid,
 					targetUid: uid,
 					ip: socket.ip
+				}, next);
+			},
+			function (next) {
+				plugins.fireHook('action:user.delete', {
+					callerUid: socket.uid,
+					uid: uid,
+					ip: socket.ip
 				});
 				next();
 			}
diff --git a/src/socket.io/user/ban.js b/src/socket.io/user/ban.js
index cdc1e20e6d..089720c59e 100644
--- a/src/socket.io/user/ban.js
+++ b/src/socket.io/user/ban.js
@@ -5,50 +5,65 @@ var user = require('../../user');
 var websockets = require('../index');
 var events = require('../../events');
 
+var plugins = require('../../plugins');
+
 module.exports = function (SocketUser) {
 
 	SocketUser.banUsers = function (socket, data, callback) {
-		// Backwards compatibility
-		if (Array.isArray(data)) {
-			data = {
-				uids: data,
-				until: 0,
-				reason: ''
-			};
+		if (!data || !Array.isArray(data.uids)) {
+			return callback(new Error('[[error:invalid-data]]'));
 		}
 
 		toggleBan(socket.uid, data.uids, function (uid, next) {
-			banUser(uid, data.until || 0, data.reason || '', next);
-		}, function (err) {
-			if (err) {
-				return callback(err);
-			}
-			async.each(data.uids, function (uid, next) {
-				events.log({
-					type: 'user-ban',
-					uid: socket.uid,
-					targetUid: uid,
-					ip: socket.ip
-				}, next);
-			}, callback);
-		});
+			async.waterfall([
+				function (next) {
+					banUser(uid, data.until || 0, data.reason || '', next);
+				},
+				function (next) {
+					events.log({
+						type: 'user-ban',
+						uid: socket.uid,
+						targetUid: uid,
+						ip: socket.ip
+					}, next);
+				},
+				function (next) {
+					plugins.fireHook('action:user.banned', {
+						callerUid: socket.uid,
+						ip: socket.ip,
+						uid: uid,
+						until: data.until > 0 ? data.until : undefined
+					});
+					next();
+				}
+			], next);
+		}, callback);
 	};
 
 	SocketUser.unbanUsers = function (socket, uids, callback) {
-		toggleBan(socket.uid, uids, user.unban, function (err) {
-			if (err) {
-				return callback(err);
-			}
-
-			async.each(uids, function (uid, next) {
-				events.log({
-					type: 'user-unban',
-					uid: socket.uid,
-					targetUid: uid,
-					ip: socket.ip
-				}, next);
-			}, callback);
-		});
+		toggleBan(socket.uid, uids, function (uid, next) {
+			async.waterfall([
+				function (next) {
+					user.unban(uid, next);
+				},
+				function (next) {
+					events.log({
+						type: 'user-unban',
+						uid: socket.uid,
+						targetUid: uid,
+						ip: socket.ip
+					}, next);
+				},
+				function (next) {
+					plugins.fireHook('action:user.unbanned', {
+						callerUid: socket.uid,
+						ip: socket.ip,
+						uid: uid
+					});
+					next();
+				}
+			], next);
+		}, callback);
 	};
 
 	function toggleBan(uid, uids, method, callback) {
diff --git a/src/socket.io/user/picture.js b/src/socket.io/user/picture.js
index fd862a475a..82404f1fe5 100644
--- a/src/socket.io/user/picture.js
+++ b/src/socket.io/user/picture.js
@@ -3,6 +3,7 @@
 var async = require('async');
 var winston = require('winston');
 var path = require('path');
+var nconf = require('nconf');
 
 var user = require('../../user');
 var plugins = require('../../plugins');
@@ -84,11 +85,14 @@ module.exports = function (SocketUser) {
 			},
 			function (userData, next) {
 				if (userData.uploadedpicture && !userData.uploadedpicture.startsWith('http')) {
-					require('fs').unlink(path.join(__dirname, '../../../public', userData.uploadedpicture), function (err) {
-						if (err) {
-							winston.error(err);
-						}
-					});
+					var pathToFile = path.join(nconf.get('base_dir'), 'public', userData.uploadedpicture);
+					if (pathToFile.startsWith(path.join(nconf.get('base_dir'), nconf.get('upload_path')))) {
+						require('fs').unlink(pathToFile, function (err) {
+							if (err) {
+								winston.error(err);
+							}
+						});
+					}
 				}
 
 				user.setUserFields(data.uid, {
diff --git a/src/user/bans.js b/src/user/bans.js
index a0b81587ee..8667641c46 100644
--- a/src/user/bans.js
+++ b/src/user/bans.js
@@ -42,15 +42,7 @@ module.exports = function (User) {
 		}
 
 		async.series(tasks, function (err) {
-			if (err) {
-				return callback(err);
-			}
-
-			plugins.fireHook('action:user.banned', {
-				uid: uid,
-				until: until > 0 ? until : undefined
-			});
-			callback();
+			callback(err);
 		});
 	};
 
@@ -61,10 +53,6 @@ module.exports = function (User) {
 			},
 			function (next) {
 				db.sortedSetsRemove(['users:banned', 'users:banned:expire'], uid, next);
-			},
-			function (next) {
-				plugins.fireHook('action:user.unbanned', {uid: uid});
-				next();
 			}
 		], callback);
 	};
diff --git a/src/user/create.js b/src/user/create.js
index 46508d1d0b..67d6baf3cd 100644
--- a/src/user/create.js
+++ b/src/user/create.js
@@ -88,7 +88,7 @@ module.exports = function (User) {
 							},
 							function (next) {
 								var sets = ['users:joindate', 'users:online'];
-								if (parseInt(userData.uid) !== 1) {
+								if (parseInt(userData.uid, 10) !== 1) {
 									sets.push('users:notvalidated');
 								}
 								db.sortedSetsAdd(sets, timestamp, userData.uid, next);
diff --git a/src/user/profile.js b/src/user/profile.js
index 7ebf7cfafd..37b280612f 100644
--- a/src/user/profile.js
+++ b/src/user/profile.js
@@ -14,7 +14,7 @@ module.exports = function (User) {
 
 	User.updateProfile = function (uid, data, callback) {
 		var fields = ['username', 'email', 'fullname', 'website', 'location',
-			'groupTitle', 'birthday', 'signature', 'aboutme', 'picture', 'uploadedpicture'];
+			'groupTitle', 'birthday', 'signature', 'aboutme'];
 
 		async.waterfall([
 			function (next) {
@@ -147,32 +147,34 @@ module.exports = function (User) {
 	}
 
 	function updateEmail(uid, newEmail, callback) {
-		User.getUserFields(uid, ['email', 'picture', 'uploadedpicture'], function (err, userData) {
-			if (err) {
-				return callback(err);
-			}
-
-			userData.email = userData.email || '';
+		async.waterfall([
+			function (next) {
+				User.getUserField(uid, 'email', next);
+			},
+			function (oldEmail, next) {
+				oldEmail = oldEmail || '';
 
-			if (userData.email === newEmail) {
-				return callback();
-			}
-			async.series([
-				async.apply(db.sortedSetRemove, 'email:uid', userData.email.toLowerCase()),
-				async.apply(db.sortedSetRemove, 'email:sorted', userData.email.toLowerCase() + ':' + uid)
-			], function (err) {
-				if (err) {
-					return callback(err);
+				if (oldEmail === newEmail) {
+					return callback();
 				}
-
+				async.series([
+					async.apply(db.sortedSetRemove, 'email:uid', oldEmail.toLowerCase()),
+					async.apply(db.sortedSetRemove, 'email:sorted', oldEmail.toLowerCase() + ':' + uid)
+				], function (err) {
+					next(err);
+				});
+			},
+			function (next) {
 				async.parallel([
 					function (next) {
 						db.sortedSetAdd('email:uid', uid, newEmail.toLowerCase(), next);
 					},
-					async.apply(db.sortedSetAdd, 'user:' + uid + ':emails', Date.now(), newEmail + ':' + Date.now()),
 					function (next) {
 						db.sortedSetAdd('email:sorted',  0, newEmail.toLowerCase() + ':' + uid, next);
 					},
+					function (next) {
+						db.sortedSetAdd('user:' + uid + ':emails', Date.now(), newEmail + ':' + Date.now(), next);
+					},
 					function (next) {
 						User.setUserField(uid, 'email', newEmail, next);
 					},
@@ -185,9 +187,11 @@ module.exports = function (User) {
 					function (next) {
 						db.sortedSetAdd('users:notvalidated', Date.now(), uid, next);
 					}
-				], callback);
-			});
-		});
+				], function (err) {
+					next(err);
+				});
+			}
+		], callback);
 	}
 
 	function updateUsername(uid, newUsername, callback) {