Today I implemented a web.config setting you can use to hide the General and Security tabs in modulesettings.aspx from users not in the Admins or Content Admins role. They can still get to the main feature settings. This will be in the next release coming soon.
About Gravatar, look at comments in Web.config for info abou disabling it and enabling an alternate avatar system. Currently there is not one where users can upload files but this is planned, you could currently upload the files as admin.
Hope it helps,