Made encryptAll() (file migration for unencrypted + legacy encrypted files) run only on first login for each user (status stored in DB)
Made recoveryAdmin user member of 'admin' user group automatically
Set recoveryadmin settings to only display on user settings if enabled by an admin
Updated encryption db xml schema