Two new skins from Yirba
Handler::Users: Properly select current skin in user edit form

This used to work fine before the AIR skin was added, because Angelic
Serenade used to be the first in the list.
SQL: Convert login_throttle.timeout to a timestamptz

Easier to work with in custom queries.
Add PS4 and Xbox One platforms
SQL: Use enum to represent platforms

I believe I didn't do this conversion earlier (back when I converted the
language types) because PostgreSQL didn't support dynamically adding new
values to an existing enum back then, and modifying an enum was a huge
pain. Recent versions do support this, so there's no reason to keep it
as a string.

...I just felt like adding some churn to the code base.
SQL: Merge users.(passwd|salt) in one column + document values

It doesn't make a whole lot to separate the hashed password and the salt
from each other, you need both to do anything with them, and from the
database perspective they're both completely opaque strings only usable
for direct comparison with other hashed strings.

This change is mostly as preparation for switching to a proper key
derivation function (sha256 isn't...) and to add support for longer
and/or binary salt.

Because the passwd field now needs to be interpreted in Perl, it's being
passed around as a binary string rather than a hex-encoded value.

API login is broken in this commit. I'll get to that.
Auth: Use a proper CSPRNG for generating salt and tokens
Use scrypt for new password hashes

I increased the N parameter to approximate about 500ms to generate the
hash. This is quite a paranoid setting for a website, but login attempts
are throttled so there's not much of a DoS factor. (Alright, password
changing feature isn't throttled so the DoS factor still exists. But
really, there's some pages with longer page generation times anyway.)

I did lower the size of the salt a bit (Crypt::ScryptKDF uses 256 bits
by default), because 64 bits of randomness should have low enough chance
of collision with only ~100k users (even with a million users,
seriously).
Multi::API: Fix crash on failed login

I broke this when changing the column type of login_throttle.timeout.
Multi::API: Fix login with the new password format changes
scrypt: Lower default N to 65536

Completely disregard my comments regarding DoS in commit
6e0a0e1d00e11da9b4eab2163e19314f752b05b5 - successful logins aren't
throttled at all. The other reason for lowering this value is because
the API requires a login for each new TCP session, and it doesn't seem
like many (any?) applications keep the TCP session alive for very long.

Still, 65536 is more secure than the default of 16384.
Let's call this 2.23
Hash session tokens with SHA-1 when storing in DB

This ensures that, if an attacker evers gets read access to the
database, he will not be able to compromise any accounts. SHA-1 suffices
here, because the data being hashed is a random 20 byte string. The
search space is so damn large that you can't sanely brute force it, nor
are rainbow tables any use at that scale.

They're not salted. The password reset tokens are also hashed in the
database and do include salt, but I've no idea why we did that.
Set httponly flag on auth cookie
Add a positive tabindex to all generated form elements

This should result in a more natural tabbing order, skipping over any
links around the forms.
Completely get rid of the old charedit perm flag
Fix tabindex on the date selector