Delete update_promos_q.

A cron job is sufficient because promote.make_daily_promotions()
is all that needs to be run.
paypal subscription: cleanly exit on duplicate transactions.
Add some missing VModhash checks.

This fixes nine XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).
Remove obsolete /api/frame and /api/noframe endpoints.

These endpoints don't appear to have been used since
reddit/reddit@a07c576d1a8a548d8b22516304c64152d5eb89a0 and I have
verified via haproxy logs that they are not ever being called.

This fixes two XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).
V*OrAdminSecret: check modhash if secret token not used.

It is necessary to do this check in V*OrAdminSecret as we cannot (and
should not) require a modhash when the secret token is being used
because this would break API compatibility and isn't necessary.

This fixes two XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).
Add app 'type' field to app create form

This will allow for differing handling of permissions based
on application type.

* Web app: Web-hosted application. Can keep a client_secret

* Installed app: e.g., android app. Client secret is not so secret
See also: https://developers.google.com/accounts/docs/OAuth2InstalledApp

* Script: For simple scripts and bots. Client secret is assumed secret.
Allow "script" apps grant_type=password

Only application devs will be permitted to use password grants,
to discourage widespread use. Password grants are intended
to be a convenience for bots & personal scripts, to encourage
use of OAuth tokens and ease transition to OAuth2.

For more info on password grants, see:
http://tools.ietf.org/html/rfc6749#section-4.3
Flair list: restrict access to mods (flair perms)
User lists: highlight row on hover
/gold/creditgild: Check comment viewing permissions.

Previously, it was possible to generate a payment blob for a comment the
user does not have permission to view (in a private subreddit or
deleted) and then use the creditgild form to see the author and content
of the comment.  This adds a check to creditgild to ensure correct
permissions at display time.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
/api/generate_payment_blob: Check comment viewing permissions.

This is not strictly necessary as /gold/creditgild is where the
information leak actually occurs, but checking here should help prevent
future leaks of the same type.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
/tb/: Check permissions before redirecting.

When the user is not logged in or has the toolbar disabled, the toolbar
endpoint will turn a link ID36 into a redirect to the submission on
reddit.  This redirect includes the slugified title of the post as well
as the subreddit it's in which could lead to a leak of information from
a private subreddit.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
wiki: Remove recursion and fix wiki page list filtering.
Pass fullname on deleted things if we're admin.
memcache: Reduce compression threshold for rendercache.
terminate_campaign: pass location to edit_campaign.
Set default geotargeting country correctly.
CommentTreeStorageV1.add_comments: write parents first.

When assembling a comment tree it's necessary that all comments
are present in parents. Writing parents first ensures this.
POST_submit: add hook for when banned domain submitted.
media: Make hooks for adding scrapers into the mix.