Stop using hardcoded from email for forgot password messages #805
Always show forgot password link on login page #771

Was being hidden unless email confirmation was enabled,
no idea why
Fix error handling when sending password reset emails #755
Better handling of unconfirmed users #599

* Redirect to login?new_confirm_email after attempted login
* Redirect to login?confirmation_failure after attemped confirmation
i18n for backported login fixes
Extra CSRF debug logging #756
Skip CSRF validation during login #756

We don't really need CSRF validation when logging in.
Forging a login request would be a bit pointless, though this
does make brute forcing the login form easier
Don't validate session IP address #756

This seemed to be causing CSRF failures. It should have simply
reset the session at most causing a single failure, but the
CSRF validation continued failing on repeated requests.
Remove IP validation, and enabling validation on session
expiration since we might as well have that.
Stop loading specific settings into Kohana config, load them all #772

This is less prone to errors on upgrade, and default can now be added
in application/config/settings.php
Make forgot password tokens use better random token #646

Fixes security issue discovered by Timothy D. Morgan <tim.morgan@owasp.org>
Forgotten password challenges were guessable based on users last login
and email address. Tokens are now generated based on a HMAC of login time
and email address using a salt and secret key specifically for these
tokens.
Repeat "7b39e86 Always show forgot password link" for uchaguzi theme

Fixes #37
Merge pull request #54 from rjmackay/security-patch-2012-008

Security patch and other fixes