gt-webdev/attendance — pull request #165 by thedekel (2012-09-07 19:17:18+00:00)
Title: better password recovery and temporary fix to bootstrap messages

This update replaces the current system of recovering passwords by only knowing the user-id with
a process where the user requests a recovery-email which include a link with both the objectId for a
unique Recovery object (see models.js) and a randomly generated secret key. by going to
`/recover/[Recovery ObjectId]?s=[secret key]` the password can be reset.

The Recovery object also contains an `expires` field which contains the time-of-creation + 1 hour. This
effectively makes recovery links only effective for 1 hour.

The update also includes a temporary fix to the issue with bootstrap messages not working with
express3 (the official library is working on it, but only started recently). The quick fix gets rid of the ability
to have multiple messages of different types and only allows at most one message. Once the official
library gets it together this will be updated, alternatively, I'll write a replacement middleware for this.