Running TODO List

 - Look into a flag SERIALIZATION_USE_ISO_8601 that converts on datetime serialization into ISO 8601
 - Look into pruning incidents after 90 days when resolved, (ossec after 7 days?)
 - add delete handler for incidents
 - ui incidents filter by priority greater then
 - Auto Disable users after 90 days of no activity unless protected? metadata.
 - Auto Disable groups after 90 days of no activty unless protected?
