Make "Sign in" button secondary if the user already has an email
Add an optional link to a page with the detailed info
Use 'securecookie' session backend instead of 'memcache'
Add an optional force_code argument to ensure_admin()
/app/reset accepts only POST requests and needs an admin code
Do not add GitHub noreply emails upon signing in