/forgot-password did not actually verify that user had an emailaddress
Fix /programs/:id/reclassify

Verify that user has the right to reclassify selected program.
Fix /accounts/:id

Regular user can only query accounts linked to them.
(This is used by classification-form:registrationEmails)
Fix /users/new

* Return 400 if required fields missing
* Replace if - else with prerequisite check + return
Fix /users/names/:names

requireRole('kavi')
Add lean() to all mongoqueries which don't need mongoose-object-wrappers

Significantly improved e.g. program search latency (100ms -> 50ms).
Extract if-names-have-changed-regenerate-allNames
Fix /programs/autosave/:id/

1) Detect fields which are allowed to be updated depending on program state (classification|reclassification) and user role.
2) Check that all input conforms to allowed fields

series and publicComments can have any changes inside them, so deviced a 'fooField*' syntax to allow any updates into such fields. Other fieldnames must equal (==) the allowed field name.

Also, only update allNames if names have changed, using program.verifyAllNamesUpToDate().
Fix double-click causing multiple requests in search.js

All buttons that cause e.g. ajax and changes to the db have to be disabled on the first click, so that someone with a slow connection double-clicking them does not cause harm.
Fix double-click causing multiple requests in classification.js
Fix double-click causing multiple requests in billing.js

Because the proe-creation-button doesn't use ajax, we can't determine when it's finished. So just disabling the submit for some seconds on each click.
Remove unused global function notIn()
Fix double-click causing multiple requests in meku.js
Fix double-click causing multiple requests in reset-password.js
Fix double-click causing multiple requests in subscriber and user management
Fix classification-form email-address select2 showing [object Object]

Also, don't show deleted users/accounts in email dropdown

oops
classification-form: Keep register button disabled while autosave ajaxes are in progress
Don't allow username to contain crazy characters
Show/generate/save account.apiToken if root
Remove indexes from program.(actors|directors)

Actors&Directors are queries from their own collection.
This was left over from previous actor|director autocomplete.