Made security rely more on the mongo implementation more completely.
Created an unverified login page (for those without a 'user' role).
Got registration working.
Smoothed registration even more.
Added flash messages to the main template.
Added flash-scope variables to rendering.