(Bug 4531): Group library JS/CSS separately from per-page JS/CSS, for better caching. Also set the scheme and library to have the same priority/ordering, so that they're grouped together when being printed
(bug 1716) Initial work on fuzzy tokens.
(bug 1716) Use bind vars instead of direct.
(bug 1716) Populate token where possible on notmodified
(bug3812) Add the sysban status + ban message to closed anon spamreports.

Patch by denise.
(bug4539) better priv checking for FAQ editing

Kareila found a weird case where faqedit:* worked but faqedit, no args,
didn't. On further investigation it looks like it's happening because
faqedit does priv checks weirdly. I pondered refactoring the priv
checks in the whole file but considering it's all going to TT soon, I
saved time and just threw in an explict check for faqedit: as well as
faqedit:*. Patch by denise.
(bug4544) Add quick needlogin for moodlist.bml

http://bugs.dwscoalition.org/show_bug.cgi?id=4544 -- exor674 mentioned
in comments to the bug that she's working on converting this to TT to
fix another bug, but since she's got so much on her plate I figured I'd
do a quick patch for the interim. This just adds a needlogin return at
the top of the page so logged-out users will be redirected. Patch by
denise.
fix using sessionStorage

uses sessionStorage, and self.identifier as key. see comment about
possible alternatives.
(bug 4431) Add ability to smart redirect to SSL version of page.
(bug 4087) Refactor backend auth code.
adding checks for some backwards compatibility

does not actually implement behavior for old browsers (pre FF 3.0, for
example), simply prevents them from throwing errors like mad.
added window to be sure
added text so that people know what the limit is

... well, this only adds it for keywords, now that i think about it. the
other two fields seem to cut off when full as they should. better
changes can and possibly should be had, but the entire page should be
jquerified anyway so... save that effort for jquerifying?
Corrected a comment - not all CAPTCHAS are because of rate-limiting.
Added explanatory comments to CAPTCHA options.
Changed textcaptcha to use the form it's passed rather than the http
request. Added code to handle odd ways of passing textcaptcha_challenge.

It doesn't work in all places though....
We had been using lj_form_auth in validating the captcha, but not
actually asking anybody to pass it to us. Now we include it in the list
of variables we need.
Tidy up
(bug 4399) Crush PNGs
Allow for the noscript version of things. Doesn't always work though...