I can restrict view User list to everybody (buy the way it's better have three options: all can see userlist, restrict view to everybody, and restrict to anonymous only).
But Anonymous user can use "Who is online" and get some information about online users (that is not good if you have very private forums)
I think that it is necessary add in config.inc.php variable to restrict checking who's online to Anonymous
