Rework page viewing restrictions based on a new account staff field.
This is set when creating a user (with a password) via admin, but
not when accounts are made with OpenID. The secured field is per-
controller and on by default.
Set staff flag to true when creating passworded users.
Add a timestamp on accounts
Try and improve process of creating users with an account. Handle
server-side validation errors.
Make clearing items from the index a syncronous action, because otherwise
deleting items causes transitory ItemNotFounds on redirect.
Fix tests