Support for insecure POP3 (without SSL)

Ideally it would be a menu selection to select POP3, POP3S, and potentially other future protocols like IMAP if desired, but I didn't want to deal with data migration at this point.  And then I was going to have a checkbox for "Secure" (on by default, obviously), but that was very hard to word as to how it was different given everything else referred to pop3s and I couldn't change that either.  So I settled on a preference:

pop3s_polling_insecure: "Poll using plain text POP3 without SSL"

Off by default.

This makes it very clear that as to what turning on that checkbox will be, and by calling it "insecure" makes sure people will think twice before turning it on.

I have not attempted to do any of the translations of the preference, I'm ot sure how you handle that.
Bugfix: Mailing list mode disables PM emails

Emailing a PM uses the user_posted event/format, but Mailing List Mode disables emails with this format.

We work around this by temporarily using "postedprivate", and then reverting back to "posted" efter the Mailing List Mode check.
Honor email_always even if notification has been read

Even if the notification has been read, send it by email if user has enabled email_always
Added test to ensure email is sent to users with email_always set even if the notification has been read
Add custom embed_by_username feature

Feature to allow each imported post to be created using a different discourse
username. A possible use case of this is a multi-author blog where discourse
is being used to track comments. This feature allows authors to receive
updates when someone leaves a comment on one of their articles because each of
the imported posts can be created using the discourse username of the author.
Corrected typo, corrected accidental tab, removed unnecessary database rollback

Corrected it "do send" to it "does send"
Removed unnecessary user.update_column (rollback happens automatically)
Replaced Tab with spaces.
Allow all /my URLs

Previously, URLs like /my/activity/posts were denied. This change allows those URLs.
better copy for site and topic invites
minor style edits on invites
switch to user glyph on accept invitation notify
add glyph to remove invite button
Consider User trust level while showing Invites tab
remove legacy (deleted) username under avatar
Merge pull request #2445 from techAPJ/invitation-patch

Consider User trust level while showing Invites tab
SECURITY: fix XSS
HACK: disable undo/redo editor functionality

TODO in a few weeks, rip out all code.
collapse tests to improve perf of suite
BUGFIX: do not strip spaces from raw_hash of posts
BUGFIX: no network could mean no posts save.
Fix typo in XSS test