diff --git a/ctp_blogr/forms.py b/ctp_blogr/forms.py
index c0100f5..dc43beb 100644
--- a/ctp_blogr/forms.py
+++ b/ctp_blogr/forms.py
@@ -1,6 +1,6 @@
 from wtforms import Form, StringField, TextAreaField, SelectField, DecimalField
 from wtforms import IntegerField
-from wtforms.validators import InputRequired, Length
+from wtforms.validators import InputRequired, Length, Email
 from wtforms.widgets import HiddenInput
 
 strip_filter = lambda x: x.strip() if x else None
@@ -26,39 +26,7 @@ class TagForm(Form):
 
 
 class UserEditForm(Form):
-    id = IntegerField(widget=HiddenInput())
-    name = StringField('Nom', validators=[InputRequired(), Length(min=1, max=255)],
+    name = StringField('Email', validators=[Email(), InputRequired(), Length(min=1, max=255)],
                            filters=[strip_filter])
 
-class HistoForm(Form):
-    no_id = IntegerField(widget=HiddenInput())
-    mvt_cash = DecimalField('Montant à ajouter au portefeuille', places=2, validators=[InputRequired()])
-
-class AllocationForm(Form):
-    no_cat = IntegerField(widget=HiddenInput())
-    classe = StringField("Classe d'actif", validators=[InputRequired(), Length(min=1, max=25)], filters=[strip_filter])
-    pc_cible = IntegerField(validators=[InputRequired()])
-    type = SelectField('Type', choices=[('ACTION','ACTION'),('AUTRE','AUTRE')])
-    ordre = IntegerField(validators=[InputRequired()])
-    bg_color = SelectField('Couleur de fond', choices=[('info','BLEU'),('danger','ROUGE'),('warning','ORANGE'),('success','VERT')])
-
-class ActifForm(Form):
-    no_id = IntegerField(widget=HiddenInput())
-    classe = SelectField('Classe')
-    symbole = StringField('Symbole', validators=[InputRequired(), Length(min=1, max=15)], filters=[strip_filter])
-    libelle = StringField('Nom', validators=[InputRequired(), Length(min=1, max=45)], filters=[strip_filter])
-    nombre = IntegerField(validators=[InputRequired()])
-    pru = DecimalField('PRU', places=3, validators=[InputRequired()])
-    ter = DecimalField('TER', places=2, validators=[InputRequired()])
-    pc_rdt = DecimalField('% rendement', places=2, validators=[InputRequired()])
-    website = StringField('Web site', validators=[Length(min=1, max=100)], filters=[strip_filter])
-
-class Actif2Form(Form):
-    no_id = IntegerField(widget=HiddenInput())
-    classe = SelectField('Classe')
-    symbole = StringField('Symbole', validators=[InputRequired(), Length(min=1, max=15)], filters=[strip_filter])
-    libelle = StringField('Libellé', validators=[InputRequired(), Length(min=1, max=45)], filters=[strip_filter])
-    pru = DecimalField('Total investi', places=3, validators=[InputRequired()])
-    cours = DecimalField('Total valeur', places=3, validators=[InputRequired()])
-    pc_rdt = DecimalField('% rendement', places=2, validators=[InputRequired()])
 
diff --git a/ctp_blogr/templates/user_edit.jinja2 b/ctp_blogr/templates/user_edit.jinja2
index db8cd59..0a0a4dd 100644
--- a/ctp_blogr/templates/user_edit.jinja2
+++ b/ctp_blogr/templates/user_edit.jinja2
@@ -8,10 +8,6 @@
         </div>
     {% endif %}
 
-    <p>
-        <a class="btn btn-default" href="{{ url_retour }}"><span class="glyphicon glyphicon-chevron-left"></span> Retour</a>
-    </p>
-
     <form action="{{ url }}" method="post" class="form">
 
         {% for error in form.name.errors %}
@@ -19,24 +15,30 @@
         {% endfor %}
 
         <div class="form-group">
-            <label class="required-field" for="name">{{form.name.label}}</label>
-            <input class="form-control" name="name" readonly type="text" value="{{form.name.data}}">
+	            <label class="required-field" for="name">{{form.name.label}}</label>
+	            {% if name == "0" %}
+	                <input class="form-control" name="name" type="text" value="{{form.name.data}}">
+	            {% else %}
+	                <input class="form-control" name="name" readonly type="text" value="{{form.name.data}}">
+	            {% endif %}
         </div>
 
-        <p class="help-block">
-            L'adresse {{ form.name.data }} est votre compte Google autorisé. Elle
-            n'est pas modifiable ici : supprimez-la de la base et ajoutez-la à
-            <code>auth.admin_emails</code> ou à la table <code>users</code> pour
-            changer d'identité.
-        </p>
-
         <br>
         <div class="form-group">
-            <button class="btn btn-primary" type="submit" name="form.submitted">
-                <span class="glyphicon glyphicon-ok"></span> Enregistrer</button>
-            {% if 'group:administrators' in request.effective_principals %}
+            <a class="btn btn-default" href="{{ url_retour }}"><span class="glyphicon glyphicon-chevron-left"></span> Retour</a>
+            {% if name == "0" %}
+                <button class="btn btn-primary" type="submit" name="form.submitted">
+                    <span class="glyphicon glyphicon-ok"></span> Enregistrer</button>
+            {% else %}
                 <button class="btn btn-warning" type="submit" name="form.deleted">
                     <span class="glyphicon glyphicon-remove"></span> Supprimer</button>
+
+                <br>
+                <br>    
+                <p class="text-danger">
+                    Attention : la suppression est définitive. Pas de retour possible.
+                </p>
+
             {% endif %}
 
         </div>
diff --git a/ctp_blogr/templates/users.jinja2 b/ctp_blogr/templates/users.jinja2
index 3f49c37..7957efa 100644
--- a/ctp_blogr/templates/users.jinja2
+++ b/ctp_blogr/templates/users.jinja2
@@ -2,26 +2,30 @@
 
 {% block content %}
     <p>
-        <a href="{{ request.route_url('home' ) }}" class="btn btn-default" role="button">
-            <span class="glyphicon glyphicon-chevron-left"></span> Retour</a>
+        <a href="{{ request.route_url('home' ) }}">[ Retour ]</a>&nbsp;
+        <a href="{{ request.route_url('user_edit', name='0') }}">[ Nouvel utilisateur ]</a>
     </p>
 
     <table id="users_list" class="table table-striped table-bordered table-condensed">
         <thead>
             <tr>
-                <th>No Id</th>
-                <th>Nom</th>
+                <th>Email</th>
+                <th>Google sub</th>
                 <th>Dernière connexion</th>
             </tr>
         </thead>
         {% for entry in users %}
             <tr>
-                <td>{{ entry.id }}</td>
                 <td>
-                    <a href="{{ request.route_url('user_edit', name=entry.name) }}">
-                        {{ entry.name }}
-                    </a>
+                    {% if entry.name == 'phuoc@caotek.fr' %}
+                        {{ entry.name }} (admin)
+                    {% else%}
+                        <a href="{{ request.route_url('user_edit', name=entry.name) }}">
+                            {{ entry.name }}
+                        </a>
+                    {% endif %}
                     </td>
+                <td>{{ entry.google_sub }}</td>
                 <td>{% if entry.last_logged %}{{ entry.last_logged.strftime("%d-%m-%Y - %H:%M") }}{% else %}jamais{% endif %}</td>
             </tr>
         {% endfor %}
diff --git a/ctp_blogr/views/default.py b/ctp_blogr/views/default.py
index e6c5b0a..6249cad 100644
--- a/ctp_blogr/views/default.py
+++ b/ctp_blogr/views/default.py
@@ -5,6 +5,7 @@ from pyramid.view import view_config
 from pyramid.httpexceptions import HTTPForbidden, HTTPFound
 from pyramid.security import remember, forget
 from ..services.google_oauth import GoogleOAuthError
+from ..models.user import User
 from ..services.user import UserService
 from ..services.blog_record import BlogRecordService
 from ..forms import UserEditForm
@@ -192,36 +193,50 @@ def users(request):
              renderer='ctp_blogr:templates/user_edit.jinja2',
              permission='manage')
 def user_edit(request):
-    # 'manage' et non 'view' : avec 'view', n'importe quel utilisateur
-    # connecte pouvait ouvrir /user_edit/<un-autre-email> et le modifier,
-    # ou /user_edit/0 pour creer une fiche.
     message = ''
     name = request.matchdict['name']
     url = request.route_url('user_edit', name=name)
-    if 'group:administrators' in request.effective_principals:
-        url_retour = request.route_url('users')
+    url_retour = request.route_url('users')
+
+    if name == '0':
+        # nouvel utilisateur
+        user = User()
+        form = UserEditForm(request.POST, user)
+        page_title = "Nouvel utilisateur"
     else:
-        url_retour = request.route_url('home')
+        # lire la fiche du user 
+        user = UserService.by_name(request, name)
+        if not user:
+            request.session.flash("Utilisateur non trouvé : %s" % name, 'danger')
+            return HTTPFound(location=url_retour)
 
-    user = UserService.by_name(request, name)
-    if not user:
-        # '0' n'existe plus : la création d'un utilisateur a disparu avec
-        # le mot de passe.
-        request.session.flash("Utilisateur non trouvé : %s" % name, 'danger')
-        return HTTPFound(location=url_retour)
-
-    form = UserEditForm(request.POST, user)
-    page_title = "Modification utilisateur"
+        form = UserEditForm(request.POST, user)
+        page_title = "Modification utilisateur"
 
     if 'form.submitted' in request.params and form.validate():
-        del form.name  # SECURITY: prevent overwriting of primary key
-        form.populate_obj(user)
-        request.session.flash("La fiche a été modifiée avec succès.", 'success')
+        # controle que name est bien un email
+        if name == '0':
+            # It is obviously a user creation.                
+            # check if the new user already exists in DB 
+            new_user = UserService.by_name(request, form.name.data)
+            if new_user:
+                message = "Utilisateur déjà créé : %s" % form.name.data
+            else:
+                form.populate_obj(user)
+                # créer le nouveau
+                request.dbsession.add(user)
+                request.session.flash("La fiche a été créée avec succès.", 'success')
+
         return HTTPFound(location=url_retour)
 
     if 'form.deleted' in request.params:
-        UserService.delete(request, user.id)
-        request.session.flash("La fiche a été supprimée avec succès.", 'success')
+        # check wether name is an admin
+        if name in 'group:administrators' in request.effective_principals:
+            request.session.flash("Il est interdit de supprimer un utisateur 'Admin'.", 'success')
+        else:        
+            UserService.delete(request, user.id)
+            request.session.flash("La fiche a été supprimée avec succès.", 'success')
+        
         return HTTPFound(location=url_retour)
 
     return {
diff --git a/setup.py b/setup.py
index 0df7d9c..595465e 100644
--- a/setup.py
+++ b/setup.py
@@ -20,6 +20,7 @@ requires = [
     'transaction',
     'zope.sqlalchemy',
     'wtforms',  # form library 2.2.1
+    'email_validator',
     'webhelpers2',  # various web building related helpers 2.0
     'markdown',
     'authlib',  # client OAuth 2.0 / OIDC pour l'authentification Google