implemented application-specific user preferences

this resulted in fairly big changes due to responsibilities being
changed: auth token is now checked by `Sendmail` and the corresponding
app ID passed to `FilterRecipients` - meaning the former's return value
becomes significant, thus it's no longer being invoked as a goroutine,
which in turn results in various related changes
fixed EditorConfig