We moved to SQLAlchemy Binds a few commits ago.
Today I fixed one of the biggest loopholes in Lastuser, one that has been around for over a year. When editing a Team within an Organization, Lastuser loaded the full list of users into the form (ids and names). We've now grown to several thousand users, so this was both (a) slow and (b) made the full list of user accounts public (though names only).
As of today the form uses an Ajax autocomplete widget. You'll have to update coaster, baseframe and lastuser on your local instances.
Kiran