Don't allow changing the OTP secret when OTP is already enabled

This fixes an OTP bypass where an attacker could request a new
OTP secret and use it to bypass two-factor auth for "/adminon".
Userpage:  Show 'banned' notice if user is banned
Make thumbnail URLs protocol-relative.

The thumbs domains are now SSL-capable. This de-duplication also brings
explicit width/height to .compact thumbnails and gets rid of a bug where
<img src="nsfw"> was generated in .compact.
Make OAuth app icon URLs protocol relative.

The thumbs domains are now SSL-capable.
Gold: support paying for one-time with creddits
API: add "distinguished" to messages
new_message: Move get_sent update out of loop

Updating the get_sent query was previously done inside the loop over
inbox_rels, which meant both that it wasn't updated if inbox_rels was
empty, and that it was (unnecessarily) updated multiple times if there
are multiple rels.

This also moves the CachedQueryMutator instantiation outside the loop,
so we only use one instance if there are multiple rels.
Messages page: don't show spam top-level messages
Message._new: add hook to check whether to inbox
Vote: pass vote_info into valid_thing
Vote: exit processing early if vote is unchanged
Vote: don't recalc valid_thing if already False
Don't show status or errors on usertableitem note form.
Make usertableitem note field more width accommodating.
Use onchange for usertableitem note.
Translate usertableitem note submit button text.
api: Add missing public_description_html.
Filters: Add /me/f/all (Gold) and /me/f/mod filter multis.
pages.py: Cleanup model import.
PromoMetrics: filter out subreddits with few daily impressions.

These subreddits aren't going to work for advertising and might
not be real subreddits.