[btfcookies]

People have run into issues where they forgot their username but know the email they created their account with. I thought the best solution for this was to allow people to use an email as their identifier when signing in.

I did take into account that emails are intended to be kept private, so its only used in the lookup on signin. Email storage in mongodb was not touched.

Features

• server/authentication.js tries to match a verified-email and falls back to the username. validateUsername rejects @ to avoid confusion with emails.
• database/account-info/ has a new file get-verified-usernames-by-email.js that is a case insensitive lookup for usernames
• routes/auth/login.js resolves the identifier before checking password and returns {expires, username}. Non string identifiers previously passed on this so they now return 400 (this was also true for routes/auth/send-password-reset-email.js so i changed it as well)
• routes/auth/verify-email.js awaits async verifyEmailLink
• updates labels and error messages with new options
• tools/create-user-indexes.js audits for duplicate verified emails and can write with --apply

[geoffrey-wu]

this diff is way too big, please clean it up

[btfcookies]

ok sorry