password reset: the table and basic functions
remove the token after using
Merge branch 'feature-hash-passwords' into feature-password-reset
reset link in the email
we no longer remind the password, but offer a reset
the beggining of the /reset screen
the password reset token checking reports a status
the password reset token checking reports a status (bad, expired, reused, good)
password reset works via creating and closing a session in a single request
i think the password reset basically works
i think the password reset basically works
move the code into a separate module
value checking for passwords, and the form as on the /initial screen
log reset request and reset use into userlog
remove session id from the successful reset page
fix a warning
a little cosmetic cleanup, constants moved to top
a comment in the reset link mail about 12 hours lifetime of the link
8-byte well-random hex session id
version upgrade, db upgrade script, 16-btye session id