Run a real auth-server daemon for testing, using the test LDAP server
for authentication.

And remove useless debug logging from actions_test.

Properly delegates authentication to the git.autistici.org/id/auth
server, removing all embedded password checks for both privileged
requests and account recovery.

The Auth object only captures the information we actually need and
use, and it's nicer not to spread SSO handling all over the place.

Do not log anything on encoding failures.

The user and all associated resources will have their status set to
'inactive'.

Fixes issue #12.

Fixes issue #10.

Add webappdb lookups for website resources

See merge request !8

Previously we were dropping these on the floor without any possibility
for the client to detect this case, because external parent ID
references (i.e. pointing at objects already in the database, rather
than temporary resource IDs in the same CreateResources request) were
dropped silently in the sortResourcesByDepth() function...

And fix an issue where validHostedEmail() was no longer checking for
availability in email alias validation.

Since this requires validating an *existing* resource, we also split
out the availability checks in the validation code from the
syntactical validation, which is a good thing anyway.

Now that we're no longer reusing the List metadata field in the
Resource, we have to adapt the validators.

All newsletters are public anyway.

Add newsletters

See merge request !7

Will set common attributes (status, shard, etc) on newly created
newsletters, just as we do for mailing lists.

Distrib

Closes #9

See merge request !6

So we can monitor its effectiveness and validate design choices.

Write requests can be forwarded to a 'leader' accountserver instance.

Previously some resource types were not validating requests for
uniqueness (the creation would have failed later, at database commit
time).

The availability API allows unauthenticated callers (i.e. everyone) to
query for existence of a specific resource, or resources that would
conflict with it in the global namespace. It's basically a public
validation check, meant so that applications that let users create
accounts can provide early feedback on availability.

Lets us tell mailing lists and newsletters apart as different resources.