authentication stuff:

• allow new local accounts to be created with usernames and passwords
  • don't allow creation of local accounts with usernames that match the @ of any existing request that has not had its account claimed by a local user
• allow new local accounts to be created with twitter authentication
• allow existing local accounts to adopt twitter accounts (and their request history) by authenticating with them
  • only allow this once
• unify user pages
• make stats correctly rank the two different kinds of Voter, without duplicates (continue from e67d3a8)
• allow existing local accounts to adopt password login when they're only using twitter auth
• extend the tests (i will do this over time. it cannot ever be completed):
  • hit every page as a user with/without both twitter auth and a usable password
  • add more fixtures for users in different states. look at all their profiles
  • test our hyper-specific twitter auth flow and its error messages
  • hit every page as an elf and not an elf, where possible
• always make a profile object against users when they are created or accessed
• resolve every new XXX comment
• remove every tweepy import
  • require an account to do an addition request
  • Twitter API: When posting a now playing tweet, if posting fails, show text to copy and paste manually and an intent URL for posting #241
• enforce good passwords. django has tools for this.

user management:

• make sure being authenticated doesn't provide access to staff- or elf-only features (this might require creating a elf group?)
  • the check metadata view
  • /vote-admin/requests/
• stop logging the contents of forms protected by trivia by default
• allow profile editing
• allow password editing
  • provide a form that's not the stock django admin one
• make the profile editing form not look super broken when an avatar is set
• have a placeholder avatar that isn't noise.png
  • apply it to unlinked TwitterUsers, too

basic workflow:

• change request links to point to a request form instead of a twitter intent

moderation tools:

• support, at the very least, the same condemn controls that are allowed for twitter users

communications:

• update the readme to explain how things work now
  • explain how it differs from the way things used to be (not done, see 993bbc2 for my thoughts on why this was a bad idea)
• probably go on the show to talk about this