Last minute current_user_can() checks

Anywhere a nonce is being used, it’s a good idea to double-check the
user capabilities as well. In both of these instances, it isn’t
necessary. But we’ll do it anyway, just in case.
Require an nonce for adding a points type

Closes a CSRF vulnerability.
Refactor nonce checks in points hook Ajax callback

Doesn’t change anything, but makes it easier to see what is going on.
Require an nonce for deleting a points type

Closes a CSRF vulnerability.
Late user capability check for no-JS hooks screen

Just in case. Not a known potential attack vector.
Refactor nonce checks in points hook Ajax callback

If this looks similar to 4b1cf86ec41cba896642a1a0228013c025dc2f14,
that’s because it is. That is for the Ajax callback which saves the
hooks’ order, this is the one that actually updates the hooks
themselves. Again, no change, just easier to read code.
Cache ranks on retrieval

Includes unit tests.

Fixes #198
Merge branch 'security-update'

Hardening and minor security fixes.
Add "ranks" keyword on wp.org

See #122
Remove a string that is no longer needed

See #122
Update the wp.org readme

Updates the description of the plugin’s features to reflect the
addition of the Ranks component, adds headings, and info about
translations and development. Also adds a screenshot of a rank group.

See #122
L10n validator

Fixes two small l10n related issues, updates the WP L10n Validator’s
cache.
1.7.0 changelog
wp.org read me: add note about bug bounty program
Update version to 1.7.0
Update language files for 1.7.0