users auth: remove redundant test ($user != FALSE)
users auth: remove unecessary loader guards

The loader already does the right thing if a library, helper, or model
is loaded more than once.
users auth: remove redundant loading of CI_Session

It's loaded by the constructor, so we don't need to load it again.
users auth: remove unecessary argument to load->model()

MY_Model always loads the database for us;
we never need to use the db_conn parameter.
users auth: remove test for Auth class; it will always exist

And if it doesn't, this is definitely one of those cases where it
would be more useful to see the PHP error.
users auth: remove unecessary argument checking

If it does not make sense to call your function with the default
parameter value, then don't give it one.  If someone makes a coding
error and calls it without enough arguments, PHP will give them a
coding error.  It's easier to debug than if it silently returns FALSE.

And the empty() string / integer is not inherently more problematic than
a non-empty() value which also doesn't exist in the database, or
whatever...  OK, it's an edge case, and sometimes it would need special
handling.  But repeating this pattern in every single function is not
the answer, and none of these checks are stopping something bad from
happening.
users auth: remove unecessary checks on ci->input->ip_address()

It never returns an empty value; on failure it returns '0.0.0.0'.

Which seems ok, as the check is for "increase_login_attempts()",
and we'll still be doing that.  If CodeIgniter can't find the
IP address, it's still useful to know about the failed logins.
Right?
users auth: remove unnecessary unset()

I'm not sure why these would have been added, but they're not doing
anything at the moment.
users auth: remove unused function auth_errors()

That is, $auth->errors is always empty.  We only ever need one error,
and it's always displayed using Template::set_message().

(validation_errors() is special; users can supply several invalid values
 at once.  Auth operations tend to be much simpler by comparison).
user forgotten password: fix error messages about the email address

The view already outputs messages from validation_errors().
The error message "Cannot find that email in our records" should not be
added if the validation fails.  Let's put this message where it belongs, so
users who miss a letter in their email address get useful feedback.
user login: don't show error when auth.allow_register==FALSE

It's enough that the "register" link is disabled.
We don't want to confuse legitimate users.

Although, I guess we need to hide the "Sign up" link
in the default theme as well!
default theme: don't show "Sign up" link if auth.allow_register==FALSE
user module: deactivate() should not show an error when it succeeds

Fix return value of user_model->deactivate(),
so we don't show "User is already inactive"
when it's not true and we actually suceeded.
user module: deactivate() shouldn't send "user activated" email

I dunno whether a "user deactivated" email would be useful
(there isn't a separate template for one at the moment).
Merge branch 'auth-cleanup' into audit-2/auth-cleanup
users auth: check for banned users

The user settings page currently sets $user->banned,
so we need to check this on login.

Ignore the old Site.Signin.Allow permission.
There used to be a "Banned" role that lacked this permission,
but it was removed a while back.
new migration 034_Banning_users_fix.php - removes Site.Signin.Allow

Remove the old Site.Signin.Allow permission
(there used to be a "Banned" role that lacked this permission,
but it was removed a while back).
users auth: remove duplication in permission_exists() and has_permission()

permission_exists() used all_perms to store the same data as perm_desc.
We can use a single variable and avoid the duplication.

Rename "all_perms"/"perm_desc" -> "permissions", and declare it in advance.

Rename "perms" -> "role_permissions", to match its comment.
users auth: fix has_permission() when called with a role parameter

Previously, has_permission() would ignore the value of the role
parameter for all but the first time it was called.
users auth: isset($a[$k]) should be faster than in_array($a, $k)

The latter requires a linear search with many string comparisons,
whereas the latter a hash table lookup (and hopefully just one
string comparison).

Maybe this is getting pedantic.  I just thought in_array() was an odd
idiom to use.