Avoid showing change of password form if the auth backend doesn't support it.

If an authentication backend has supports_change_password set to False, the
account preferences panel still shows the form to change the password, while it
shouldn't be there.

The problem here is that the is_visible() implementation was located in the
wrong class. Instead of being in ChangePasswordForm, it ended up in
AccountSettingsForm, so that if the auth backend didn't have the ability to
change the password, it would instead prevent the user from changing their
timezone.

Testing Done:

Before: If you use a backend that has supports_change_password as False, your
/account/preferences page still has Authentication tab, which corresponds to
password changing. If you try to change your password, you get an error as
described in the bug. You can also notice that the settings bar went missing
for some reason.

After: If supports_change_password is False for your backend, the
Authentication tab isn't visible, and the Settings tab is back!

I also verified that nothing changed for backends that support password change.

Bugs closed: 3255

Reviewed at https://reviews.reviewboard.org/r/5797/
Merge branch 'release-2.0.x'
Allow users to add and remove widgets from the admin dashboard.

This is the second half of adding configurability to the admin dashboard. Users
can add widgets to their admin dashboard by clicking on "Add Widgets", which
will open a modal displaying a list of widgets that they can choose from. They
can remove widgets by clicking the X icon on the upper righthand corner of the
widget in question.

Testing Done:
Removed widgets and added them back to make sure that newly added widgets
appeared below the old widgets.

Reviewed at https://reviews.reviewboard.org/r/5622/
Prevent JavaScript errors on the Manual Updates pages.

The Manual Updates page tried to load the JS catalog, needed in order to
expose gettext() for the other scripts being loaded. That path wasn't
explicitly allowed, resulting in HTML being sent back as the script
contents, causing the browser to show some errors.

We may want to consider just blocking off all script loading. That will
require blocking extensions as well, though, and possibly daeling with
other corner cases. In the meantime, allow the JS catalog to be loaded.

Reviewed at https://reviews.reviewboard.org/r/5800/
Fix the styling of titles in the admin UI.

Titles in the admin UI were previously styled by the 'h1.title' rule,
which we replaced with '.box-title'. However, the admin UI doesn't use
boxes in the same sense as the rest of the UI, due to Django's built-in
styling.

This adds an explicit rule for titles in the admin UI, allowing them
once again to use the same styles as our other boxes.

Reviewed at https://reviews.reviewboard.org/r/5801/
Fix fetching original and patched files through the web API.

The handlers for getting original/patched files in the API were
expecting a URL parameter that doesn't exist. It would always attempt to
fetch using the draft filediff resource, instead of intelligently
choosing between that and the published filediff resource.

By using the correct URL parameter name, and using that parameter
correctly, we can fetch the original/patched files correctly.

Reviewed at https://reviews.reviewboard.org/r/5804/
Merge branch 'release-2.0.x'
Remove the Pygments runtime dependency checks.

We have some really old code (Makefile days) for checking if syntax
highlighting can be enabled, based on having Pygments, and having a
minimum version of it. This code, in combination with some other code,
ends up creating some ugly and unnecessary circular dependencies between
parts of the product that only appear if you start importing certain
modules first.

These days, we have actual dependencies that get installed with the
product. This check is no longer useful, and causes more harm than good.
This change removes the check and all calls.

Reviewed at https://reviews.reviewboard.org/r/5811/
Condense some unnecessarily verbose code in reviewboard.admin.

Due to changes made over time to the admin widget code, we ended up
having some code in reviewboard.admin.signals that didn't really belong
there. A signals.py file should be fairly minimal and contain actual
signals, but this one had just signal handlers that were called from
reviewboard.admin itself.

This change just removes the file and moves that code directly into
reviewboard.admin, to keep things simple and consistent.

Reviewed at https://reviews.reviewboard.org/r/5812/
Bump django dependency to 1.7.13.

Picking up the latest security release for Django.
Merge branch 'release-1.7.x' into release-2.0.x
Bump django dependency to 1.6.5

Picking up the latest security release for Django.
Merge branch 'release-2.0.x'
Change 'password_reset_done' URL name to 'password_reset_complete'

The built-in password reset views use a different name for the last page in the
flow than we did before, and somehow we never noticed this until recently.
Trivial fix.

Fixes bug 3345.
Use 'cvs version' instead of 'cvs rls' to test remote repositories.

'cvs rls' is only available in CVS 1.12+, which isn't yet considered stable.
Fortunately, if 'cvs version' is run with a CVSROOT, it will end up checking
whether that CVSROOT is valid, which is perfect for our needs.

Testing done: Ran unit tests.

Fixes bug 3343.

Reviewed at https://reviews.reviewboard.org/r/5831/
Merge branch 'release-1.7.x' into release-2.0.x
Merge branch 'release-2.0.x'
Update the 2.0 draft release notes.

This adds in everything from the 2.0 RC3 release notes that wasn't a regression
or fix for a 2.0-only feature.

Testing done: Built HTML docs and read through them.

Reviewed at https://reviews.reviewboard.org/r/5832/
Fix the security checklist with super-locked-down webservers.

Some web server configurations prevent uploading of files with suspicious types
(like .cgi, .php, etc). In this case, the security checklist would throw a 500
because it would fail to even save the file, much less fetch it.

I've rearranged things a little bit to catch OSError exceptions when saving
files and remove them from the list of things that we then test/delete.

Testing done:
Manually caused one of the file types to throw an OSError and saw that the
security checks still passed.

Fixes bug 3341.

Reviewed at https://reviews.reviewboard.org/r/5827/
Merge branch 'release-2.0.x'