Add tests for setting your own password; fix an issue they showed.

Because the set_password mechanism makes an immediate change to the
LDAP, changing your own password via nemesis was previously broken.

While the password change itself would work, any changes at the same
time would have failed (because the save() would have been bound with
now invalid credentials). The more recent change to prevent students
modifying their own names also caused the entire request to 500, as
the ah.user.is_student check tried to run against the now NullUser
that the auth helper returned.

Move the password change to the end of the method to ensure that the
other changes go through ok, and add tests for changing your own passwor
on its own and in combination with other changes.

Change-Id: I01bff0b53bc1c7e09d31a392b1db33ccc9a79d34
Fix #2164: Remove need to re-login after changing own password.

Detect that the user being edit is the one that is logged in, and
that the password is being changed. Use the new value to perform a
new login once the edit request returns, thus ensuring that any
future requests use the new password value.

Change-Id: Ie0dcc4e49b27c44029f90660431d133f5c09938d
Fix #2163: Ignore blank name values but require them on the form.

This merges a fix which avoids the back-end 500ing when asked to set the
user's name to an empty string by ignoring it. In order to reduce the
chances of this occurring, the front-end also now labels these fields
as required.
Minor refactoring to simplify other changes.

Move adding the value to the build to a separate step, only fetch
the majorkey in one place.

This makes it easier to modify the value if needed.

Change-Id: I360ec3351f3dd4af285d463d58cade004a3c1099
Actually instantiate the templater in the test for this.

Change-Id: Iaff45e30427bf32653e0bac6a3d1d197a7285313
Introduce a helper for constructing the item under test.

This will make it possible to tweak it for all tests in a simple manner.

Change-Id: Ib328cecf4046dd0a19469e2bdbfc1d47f68ad624
Add a mechanism to escape tagged template blocks.

By adding a colon (:) to the start of the braced block, the block's
value is marked as 'safe', and doesn't need escaping. For the moment,
the escaping function doesn't actually do anything.

Change-Id: Ib09b84dd5ed4671ac8cc2b1f97116e7aaab92796
Add HTML escaping by default, label some fields as safe.

I believe this resolves the possible HTML injection issues raised by
Alex, covering both raw html and <input> fields. I've tried to only
mark safe those fields that are expected to contain html (and I think
these are all constructed from other templates too), so some fields
which may not need escaping will be covered anyway.

I've manually tested this by inputting the nasty input:
   "><script>alert('XSS!');</script><!--
into every field I could see, and this appears to cover us for web
output, though clearly nothing stops this getting into emails (etc.)
that we may emit elsewhere.

Change-Id: I8a65031228bd8917824ce4aedb3402332afca146
Add a helper for checking name validity.

For the most part, we don't care what the user's name is. However,
the first character is used to build their username so we need to
make sure that this is an alphabetic character.

Change-Id: I9539cab09eae4807b1d380a3becf1e7f0fe7a71b
Reject registrations of names that don't start with a letter.

Since we use the names to construct the username, and then check
whether that name (plus an incrementing number) exists, there's the
potential for the user to either mess with our LDAP (unlikely with
the two characters available) or just get LDAP to cause us to 500
at them. The latter is much more likely, and results in the regisrations
form becoming a bit dead, which this should resolve.

Change-Id: Icf3e259a13b97d83c966d60f26c77a99b3adeaa8
Bump libnemesis to pick up reset of withdrawn group.

Change-Id: I69d5ce1bcd05b232a71d7979af2f507f4b1caef4
Tweak import to simplify dependency handling.

At the moment, the sqlitewrappers also import the mailer, meaning
that anyone wanting to import just one of the wrappers needs to either
import the whole module, or import something else which does so first.
This is a non-ideal fix, but provides some improvement.

Change-Id: I1b61c346ca24cc9dc469bd1dd8a8d0aa3e1d006a
Break out some common test helpers to their own file.

Change-Id: If226f45c4464b768d655338be724f4c5e3a59372
Extract unit tests from the api tests, add test runner script.

This creates a new unit-tests directory under test/, which is used
to contain tests which test the nemesis internals directly. At some
point it may make sense for these internals and their tests to move
to libnemesis, but for now it's at least clearer what's what.

This also adds a ./run-tests script which will run all the current
tests (ie, not the client-tests) and return a summed return code.

Change-Id: I379e9e3ac7b9ff1277e540490de431d96064badb
Minor tidyup to clarify what's going on.

Change-Id: Ib02c46959ddecea11ad0046f41e2343941ce4bf6
Fix #2215: Fix self-modification in nemesis front-end.

At the moment, blueshirts don't actually have a type listing, so
neither of the radio buttons will be checked for them. Previously,
this resulted in the JS erroring because the .value attribute didn't
exist on the undefiend 0th index, and the form attempted to submit
via plain GET. Avoid this by checking the length of the returned
array, and only considering setting the value if it is suitable.

Change-Id: I6d7d3c527a57129a326992cd5651cdfee0687bbd
Remove the outdateed requirements list.

This list includes a large number of things that aren't directly
needed, and isn't at all clear about what is actually needed.
Remove it, and ensure that the readme contains all the needed info.

Change-Id: Id5a44ed16b4fe88cd1838613def72750667881b8
Ignore ChromeDriver & the new local.py files.

Change-Id: I6e45408ef2832b62365927043a6ae5123092b8f1
Bump libnemesis to pick up test fixes.

This adds a bunch of team related tests, and ensures that the newly
added withdrawn_student doesn't cause any test failures.

Change-Id: I58ab16af36700ee5a74ab3f88aaa9f9440e32105
Bump libnemesis for can_withdraw(user) helper.

This determines if a user can withdraw another user.

Change-Id: I7850bd7f8ee05b4887f473d3b503d7858cbe15ac