Fix email validation on user creation

Make sure the email field isn't empty in the first place instead of
returning 500 afterwards.
Fix email validation in profile creation and update

* Disallow change of email address to an email address which is already
used by another account (see comment in #172)
 * Allow the use of email addresses of deleted accounts on user creation
/ profile update (note: use ban instead of delete in case of abuse)
Don't force lowercased email addresses

According to RFC 5321 (see [0]), the part before @ can be case
sensitive. While we don't allow multiple accounts with email addresses
which are differ only in case, we should store the email address in the
database as entered by the user.

[0] http://stackoverflow.com/a/9808332/201743
Log email address changes

As email addresses are one of the validated features of a user, we
should store email address changes. This commit does that in a minimal
fashion by logging email address changes.
Log OpenID revocations

As OpenIDs are another validated feature of a user, revocation of
OpenIDs is logged.
Fix username validation after OpenID registration

Use the same rules after OpenID signup for usernames as in a normal
registration.
Fix email and username validators in user import

Use the same rules for email and username validation as everywhere else.
Fix typo in username validation message
Allow different OpenID attribute exchange schemas

As different OpenID providers use different schema urls for attribute
exchange, the schema used for emails can now be adjusted to each
provider.

More concretely, Yahoo OpenID now also returns an email address.
Only trust defined OpenID providers

As everybody can install an OpenID provider, this commit adds a list of
trusted OpenID providers.

This is currently Google, Yahoo and MyOpenID, but can easily be
extended.

Only email addresses of trusted OpenID providers are automatically
validated, while others will receive an email with a confirmation link
as after normal registrations.

Note that it is still possible to create an account without email
address, if the OpenID provider returns none.
Match OpenID emails to existing users

If an email address provided by OpenID attribute exchange upon on-
the-fly OpenID signup is already used by another user:

1. Do not simply create a new user with the same (duplicate) email
address (as written in a comment in #172), but

2. Automatically log in the user with that email address assigned, if
the OpenID provider is trusted, and

3. Do not log in or sign up, but issue a warning, if this happens with a
non trusted OpenID provider. Otherwise this would allow to login as any
Adhocracy user by faking an OpenID provider.
Add/Fix a couple of OpenID related flash messages.
Use base_url in OpenID redirect
Skip form action attribute

As this form is always submitted from the same page as the submit action
url, this can be skipped (see [0]).

This avoids unnecessary `base_url` fiddling.

[0] http://stackoverflow.com/a/1132015/201743
AuthCheck: docstring, garden
Add require_valid_email attribute to instance

This attribute determines whether email validation is mandatory in this
instance.
Allow check for validated email (fixes #142)

Add valid_email check to AuthCheck and use it in all instance related
permission checks for write (not readonly) actions.
Add attention getter for missing email validation
Allow dynamic overlay feature for actions needing valid emails
Use dynamic overlay for proposal create button

The same should be done in all other places.