diff --git a/src/applications/auth/controller/PhabricatorAuthLinkController.php b/src/applications/auth/controller/PhabricatorAuthLinkController.php
index 46edb68126..4da0fc1c1f 100644
--- a/src/applications/auth/controller/PhabricatorAuthLinkController.php
+++ b/src/applications/auth/controller/PhabricatorAuthLinkController.php
@@ -1,133 +1,138 @@
 <?php
 
 final class PhabricatorAuthLinkController
   extends PhabricatorAuthController {
 
   private $action;
   private $providerKey;
 
   public function willProcessRequest(array $data) {
     $this->providerKey = $data['pkey'];
     $this->action = $data['action'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
       $this->providerKey);
     if (!$provider) {
       return new Aphront404Response();
     }
 
     switch ($this->action) {
       case 'link':
         if (!$provider->shouldAllowAccountLink()) {
           return $this->renderErrorPage(
             pht('Account Not Linkable'),
             array(
               pht('This provider is not configured to allow linking.'),
             ));
         }
         break;
       case 'refresh':
         if (!$provider->shouldAllowAccountRefresh()) {
           return $this->renderErrorPage(
             pht('Account Not Refreshable'),
             array(
               pht('This provider does not allow refreshing.'),
             ));
         }
         break;
       default:
         return new Aphront400Response();
     }
 
     $account = id(new PhabricatorExternalAccount())->loadOneWhere(
       'accountType = %s AND accountDomain = %s AND userPHID = %s',
       $provider->getProviderType(),
       $provider->getProviderDomain(),
       $viewer->getPHID());
 
     switch ($this->action) {
       case 'link':
         if ($account) {
           return $this->renderErrorPage(
             pht('Account Already Linked'),
             array(
               pht(
                 'Your Phabricator account is already linked to an external '.
                 'account for this provider.'),
             ));
         }
         break;
       case 'refresh':
         if (!$account) {
           return $this->renderErrorPage(
             pht('No Account Linked'),
             array(
               pht(
                 'You do not have a linked account on this provider, and thus '.
                 'can not refresh it.'),
             ));
         }
         break;
       default:
         return new Aphront400Response();
     }
 
     $panel_uri = '/settings/panel/external/';
 
     PhabricatorCookies::setClientIDCookie($request);
 
     switch ($this->action) {
       case 'link':
+        id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+          $viewer,
+          $request,
+          $panel_uri);
+
         $form = $provider->buildLinkForm($this);
         break;
       case 'refresh':
         $form = $provider->buildRefreshForm($this);
         break;
       default:
         return new Aphront400Response();
     }
 
     if ($provider->isLoginFormAButton()) {
       require_celerity_resource('auth-css');
       $form = phutil_tag(
         'div',
         array(
           'class' => 'phabricator-link-button pl',
         ),
         $form);
     }
 
     switch ($this->action) {
       case 'link':
         $name = pht('Link Account');
         $title = pht('Link %s Account', $provider->getProviderName());
         break;
       case 'refresh':
         $name = pht('Refresh Account');
         $title = pht('Refresh %s Account', $provider->getProviderName());
         break;
       default:
         return new Aphront400Response();
     }
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb(pht('Link Account'), $panel_uri);
     $crumbs->addTextCrumb($provider->getProviderName($name));
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
 }
diff --git a/src/applications/conduit/controller/PhabricatorConduitTokenController.php b/src/applications/conduit/controller/PhabricatorConduitTokenController.php
index 1bb0dfa2b9..62260b9989 100644
--- a/src/applications/conduit/controller/PhabricatorConduitTokenController.php
+++ b/src/applications/conduit/controller/PhabricatorConduitTokenController.php
@@ -1,72 +1,76 @@
 <?php
 
 /**
  * @group conduit
  */
 final class PhabricatorConduitTokenController
   extends PhabricatorConduitController {
 
   public function processRequest() {
-
     $user = $this->getRequest()->getUser();
 
+    id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $user,
+      $this->getRequest(),
+      '/');
+
     // Ideally we'd like to verify this, but it's fine to leave it unguarded
     // for now and verifying it would need some Ajax junk or for the user to
     // click a button or similar.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     $old_token = id(new PhabricatorConduitCertificateToken())
       ->loadOneWhere(
         'userPHID = %s',
         $user->getPHID());
     if ($old_token) {
       $old_token->delete();
     }
 
     $token = id(new PhabricatorConduitCertificateToken())
       ->setUserPHID($user->getPHID())
       ->setToken(Filesystem::readRandomCharacters(40))
       ->save();
 
     unset($unguarded);
 
     $pre_instructions = pht(
       'Copy and paste this token into the prompt given to you by '.
       '`arc install-certificate`');
 
     $post_instructions = pht(
       'After you copy and paste this token, `arc` will complete '.
       'the certificate install process for you.');
 
     Javelin::initBehavior('select-on-click');
 
     $form = id(new AphrontFormView())
       ->setUser($user)
       ->appendRemarkupInstructions($pre_instructions)
       ->appendChild(
         id(new AphrontFormTextAreaControl())
           ->setLabel(pht('Token'))
           ->setHeight(AphrontFormTextAreaControl::HEIGHT_VERY_SHORT)
           ->setReadonly(true)
           ->setSigil('select-on-click')
           ->setValue($token->getToken()))
       ->appendRemarkupInstructions($post_instructions);
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb(pht('Install Certificate'));
 
     $object_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Certificate Token'))
       ->setForm($form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $object_box,
       ),
       array(
         'title' => pht('Certificate Install Token'),
         'device' => true,
       ));
   }
 }
diff --git a/src/applications/diffusion/panel/DiffusionSetPasswordPanel.php b/src/applications/diffusion/panel/DiffusionSetPasswordPanel.php
index b9d90c8306..a17241f4c3 100644
--- a/src/applications/diffusion/panel/DiffusionSetPasswordPanel.php
+++ b/src/applications/diffusion/panel/DiffusionSetPasswordPanel.php
@@ -1,244 +1,249 @@
 <?php
 
 final class DiffusionSetPasswordPanel extends PhabricatorSettingsPanel {
 
   public function isEditableByAdministrators() {
     return true;
   }
 
   public function getPanelKey() {
     return 'vcspassword';
   }
 
   public function getPanelName() {
     return pht('VCS Password');
   }
 
   public function getPanelGroup() {
     return pht('Authentication');
   }
 
   public function isEnabled() {
     return PhabricatorEnv::getEnvConfig('diffusion.allow-http-auth');
   }
 
   public function processRequest(AphrontRequest $request) {
     $viewer = $request->getUser();
     $user = $this->getUser();
 
+    $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $viewer,
+      $request,
+      '/settings/');
+
     $vcspassword = id(new PhabricatorRepositoryVCSPassword())
       ->loadOneWhere(
         'userPHID = %s',
         $user->getPHID());
     if (!$vcspassword) {
       $vcspassword = id(new PhabricatorRepositoryVCSPassword());
       $vcspassword->setUserPHID($user->getPHID());
     }
 
     $panel_uri = $this->getPanelURI('?saved=true');
 
     $errors = array();
 
     $e_password = true;
     $e_confirm = true;
 
     if ($request->isFormPost()) {
       if ($request->getBool('remove')) {
         if ($vcspassword->getID()) {
           $vcspassword->delete();
           return id(new AphrontRedirectResponse())->setURI($panel_uri);
         }
       }
 
       $new_password = $request->getStr('password');
       $confirm = $request->getStr('confirm');
       if (!strlen($new_password)) {
         $e_password = pht('Required');
         $errors[] = pht('Password is required.');
       } else {
         $e_password = null;
       }
 
       if (!strlen($confirm)) {
         $e_confirm = pht('Required');
         $errors[] = pht('You must confirm the new password.');
       } else {
         $e_confirm = null;
       }
 
       if (!$errors) {
         $envelope = new PhutilOpaqueEnvelope($new_password);
 
         if ($new_password !== $confirm) {
           $e_password = pht('Does Not Match');
           $e_confirm = pht('Does Not Match');
           $errors[] = pht('Password and confirmation do not match.');
         } else if ($viewer->comparePassword($envelope)) {
           // NOTE: The above test is against $viewer (not $user), so that the
           // error message below makes sense in the case that the two are
           // different, and because an admin reusing their own password is bad,
           // while system agents generally do not have passwords anyway.
 
           $e_password = pht('Not Unique');
           $e_confirm = pht('Not Unique');
           $errors[] = pht(
             'This password is the same as another password associated '.
             'with your account. You must use a unique password for '.
             'VCS access.');
         } else if (
           PhabricatorCommonPasswords::isCommonPassword($new_password)) {
           $e_password = pht('Very Weak');
           $e_confirm = pht('Very Weak');
           $errors[] = pht(
             'This password is extremely weak: it is one of the most common '.
             'passwords in use. Choose a stronger password.');
         }
 
 
         if (!$errors) {
           $vcspassword->setPassword($envelope, $user);
           $vcspassword->save();
 
           return id(new AphrontRedirectResponse())->setURI($panel_uri);
         }
       }
     }
 
     $title = pht('Set VCS Password');
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->appendRemarkupInstructions(
         pht(
           'To access repositories hosted by Phabricator over HTTP, you must '.
           'set a version control password. This password should be unique.'.
           "\n\n".
           "This password applies to all repositories available over ".
           "HTTP."));
 
     if ($vcspassword->getID()) {
       $form
         ->appendChild(
           id(new AphrontFormPasswordControl())
             ->setLabel(pht('Current Password'))
             ->setDisabled(true)
             ->setValue('********************'));
     } else {
       $form
         ->appendChild(
           id(new AphrontFormMarkupControl())
             ->setLabel(pht('Current Password'))
             ->setValue(phutil_tag('em', array(), pht('No Password Set'))));
     }
 
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setName('password')
           ->setLabel(pht('New VCS Password'))
           ->setError($e_password))
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setName('confirm')
           ->setLabel(pht('Confirm VCS Password'))
           ->setError($e_confirm))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Change Password')));
 
 
     if (!$vcspassword->getID()) {
       $is_serious = PhabricatorEnv::getEnvConfig(
         'phabricator.serious-business');
 
       $suggest = Filesystem::readRandomBytes(128);
       $suggest = preg_replace('([^A-Za-z0-9/!().,;{}^&*%~])', '', $suggest);
       $suggest = substr($suggest, 0, 20);
 
       if ($is_serious) {
         $form->appendRemarkupInstructions(
           pht(
             'Having trouble coming up with a good password? Try this randomly '.
             'generated one, made by a computer:'.
             "\n\n".
             "`%s`",
             $suggest));
       } else {
         $form->appendRemarkupInstructions(
           pht(
             'Having trouble coming up with a good password? Try this '.
             'artisinal password, hand made in small batches by our expert '.
             'craftspeople: '.
             "\n\n".
             "`%s`",
             $suggest));
       }
     }
 
     $hash_envelope = new PhutilOpaqueEnvelope($vcspassword->getPasswordHash());
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Current Algorithm'))
         ->setValue(
           PhabricatorPasswordHasher::getCurrentAlgorithmName($hash_envelope)));
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Best Available Algorithm'))
         ->setValue(PhabricatorPasswordHasher::getBestAlgorithmName()));
 
     if (strlen($hash_envelope->openEnvelope())) {
       if (PhabricatorPasswordHasher::canUpgradeHash($hash_envelope)) {
         $errors[] = pht(
           'The strength of your stored VCS password hash can be upgraded. '.
           'To upgrade, either: use the password to authenticate with a '.
           'repository; or change your password.');
       }
     }
 
     $object_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setForm($form)
       ->setFormErrors($errors);
 
     $remove_form = id(new AphrontFormView())
       ->setUser($viewer);
 
     if ($vcspassword->getID()) {
       $remove_form
         ->addHiddenInput('remove', true)
         ->appendRemarkupInstructions(
           pht(
             'You can remove your VCS password, which will prevent your '.
             'account from accessing repositories.'))
         ->appendChild(
           id(new AphrontFormSubmitControl())
             ->setValue(pht('Remove Password')));
     } else {
       $remove_form->appendRemarkupInstructions(
         pht(
           'You do not currently have a VCS password set. If you set one, you '.
           'can remove it here later.'));
     }
 
     $remove_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Remove VCS Password'))
       ->setForm($remove_form);
 
     $saved = null;
     if ($request->getBool('saved')) {
       $saved = id(new AphrontErrorView())
         ->setSeverity(AphrontErrorView::SEVERITY_NOTICE)
         ->setTitle(pht('Password Updated'))
         ->appendChild(pht('Your VCS password has been updated.'));
     }
 
     return array(
       $saved,
       $object_box,
       $remove_box,
     );
   }
 
 }
diff --git a/src/applications/passphrase/controller/PassphraseCredentialRevealController.php b/src/applications/passphrase/controller/PassphraseCredentialRevealController.php
index b11b370bbc..d1357c44c2 100644
--- a/src/applications/passphrase/controller/PassphraseCredentialRevealController.php
+++ b/src/applications/passphrase/controller/PassphraseCredentialRevealController.php
@@ -1,93 +1,98 @@
 <?php
 
 final class PassphraseCredentialRevealController
   extends PassphraseController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $credential = id(new PassphraseCredentialQuery())
       ->setViewer($viewer)
       ->withIDs(array($this->id))
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->needSecrets(true)
       ->executeOne();
     if (!$credential) {
       return new Aphront404Response();
     }
 
     $view_uri = '/K'.$credential->getID();
 
+    $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $viewer,
+      $request,
+      $view_uri);
+
     if ($request->isFormPost()) {
       if ($credential->getSecret()) {
         $body = id(new PHUIFormLayoutView())
           ->appendChild(
             id(new AphrontFormTextAreaControl())
               ->setLabel(pht('Plaintext'))
               ->setReadOnly(true)
               ->setHeight(AphrontFormTextAreaControl::HEIGHT_VERY_TALL)
               ->setValue($credential->getSecret()->openEnvelope()));
       } else {
         $body = pht('This credential has no associated secret.');
       }
 
       // NOTE: Disable workflow on the cancel button to reload the page so
       // the viewer can see that their view was logged.
 
       $dialog = id(new AphrontDialogView())
         ->setUser($viewer)
         ->setWidth(AphrontDialogView::WIDTH_FORM)
         ->setTitle(pht('Credential Secret (%s)', $credential->getMonogram()))
         ->appendChild($body)
         ->setDisableWorkflowOnCancel(true)
         ->addCancelButton($view_uri, pht('Done'));
 
       $type_secret = PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET;
       $xactions = array(id(new PassphraseCredentialTransaction())
         ->setTransactionType($type_secret)
         ->setNewValue(true));
 
       $editor = id(new PassphraseCredentialTransactionEditor())
         ->setActor($viewer)
         ->setContinueOnNoEffect(true)
         ->setContentSourceFromRequest($request)
         ->applyTransactions($credential, $xactions);
 
       return id(new AphrontDialogResponse())->setDialog($dialog);
     }
 
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
     if ($is_serious) {
       $body = pht(
         'The secret associated with this credential will be shown in plain '.
         'text on your screen.');
     } else {
       $body = pht(
         'The secret associated with this credential will be shown in plain '.
         'text on your screen. Before continuing, wrap your arms around your '.
         'monitor to create a human shield, keeping it safe from prying eyes. '.
         'Protect company secrets!');
     }
 
     $dialog = id(new AphrontDialogView())
       ->setUser($viewer)
       ->setTitle(pht('Really show secret?'))
       ->appendChild($body)
       ->addSubmitButton(pht('Show Secret'))
       ->addCancelButton($view_uri);
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
 }
diff --git a/src/applications/people/controller/PhabricatorPeopleCreateController.php b/src/applications/people/controller/PhabricatorPeopleCreateController.php
index fe7815b008..498e096199 100644
--- a/src/applications/people/controller/PhabricatorPeopleCreateController.php
+++ b/src/applications/people/controller/PhabricatorPeopleCreateController.php
@@ -1,82 +1,87 @@
 <?php
 
 final class PhabricatorPeopleCreateController
   extends PhabricatorPeopleController {
 
   public function processRequest() {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
+    id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $admin,
+      $request,
+      $this->getApplicationURI());
+
     $v_type = 'standard';
     if ($request->isFormPost()) {
       $v_type = $request->getStr('type');
 
       if ($v_type == 'standard' || $v_type == 'bot') {
         return id(new AphrontRedirectResponse())->setURI(
           $this->getApplicationURI('new/'.$v_type.'/'));
       }
     }
 
     $title = pht('Create New User');
 
     $standard_caption = pht(
       'Create a standard user account. These users can log in to Phabricator, '.
       'use the web interface and API, and receive email.');
 
     $standard_admin = pht(
       'Administrators are limited in their ability to access or edit these '.
       'accounts after account creation.');
 
     $bot_caption = pht(
       'Create a bot/script user account, to automate interactions with other '.
       'systems. These users can not use the web interface, but can use the '.
       'API.');
 
     $bot_admin = pht(
       'Administrators have greater access to edit these accounts.');
 
     $form = id(new AphrontFormView())
       ->setUser($admin)
       ->appendRemarkupInstructions(
         pht(
           'Choose the type of user account to create. For a detailed '.
           'explanation of user account types, see [[ %s | User Guide: '.
           'Account Roles ]].',
           PhabricatorEnv::getDoclink('User Guide: Account Roles')))
       ->appendChild(
         id(new AphrontFormRadioButtonControl())
           ->setLabel(pht('Account Type'))
           ->setName('type')
           ->setValue($v_type)
           ->addButton(
             'standard',
             pht('Create Standard User'),
             hsprintf('%s<br /><br />%s', $standard_caption, $standard_admin))
           ->addButton(
             'bot',
             pht('Create Bot/Script User'),
             hsprintf('%s<br /><br />%s', $bot_caption, $bot_admin)))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->addCancelButton($this->getApplicationURI())
           ->setValue(pht('Continue')));
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb($title);
 
     $box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->appendChild($form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $box,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
 }
diff --git a/src/applications/people/controller/PhabricatorPeopleEmpowerController.php b/src/applications/people/controller/PhabricatorPeopleEmpowerController.php
index 7ee8ffc6c2..8b232ec9bb 100644
--- a/src/applications/people/controller/PhabricatorPeopleEmpowerController.php
+++ b/src/applications/people/controller/PhabricatorPeopleEmpowerController.php
@@ -1,71 +1,76 @@
 <?php
 
 final class PhabricatorPeopleEmpowerController
   extends PhabricatorPeopleController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer($admin)
       ->withIDs(array($this->id))
       ->executeOne();
     if (!$user) {
       return new Aphront404Response();
     }
 
     $profile_uri = '/p/'.$user->getUsername().'/';
 
+    id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $admin,
+      $request,
+      $profile_uri);
+
     if ($user->getPHID() == $admin->getPHID()) {
       return $this->newDialog()
         ->setTitle(pht('Your Way is Blocked'))
         ->appendParagraph(
           pht(
             'After a time, your efforts fail. You can not adjust your own '.
             'status as an administrator.'))
         ->addCancelButton($profile_uri, pht('Accept Fate'));
     }
 
     if ($request->isFormPost()) {
       id(new PhabricatorUserEditor())
         ->setActor($admin)
         ->makeAdminUser($user, !$user->getIsAdmin());
 
       return id(new AphrontRedirectResponse())->setURI($profile_uri);
     }
 
     if ($user->getIsAdmin()) {
       $title = pht('Remove as Administrator?');
       $short = pht('Remove Administrator');
       $body = pht(
         'Remove %s as an administrator? They will no longer be able to '.
         'perform administrative functions on this Phabricator install.',
         phutil_tag('strong', array(), $user->getUsername()));
       $submit = pht('Remove Administrator');
     } else {
       $title = pht('Make Administrator?');
       $short = pht('Make Administrator');
       $body = pht(
         'Empower %s as an admistrator? They will be able to create users, '.
         'approve users, make and remove administrators, delete accounts, and '.
         'perform other administrative functions on this Phabricator install.',
         phutil_tag('strong', array(), $user->getUsername()));
       $submit = pht('Make Administrator');
     }
 
     return $this->newDialog()
       ->setTitle($title)
       ->setShortTitle($short)
       ->appendParagraph($body)
       ->addCancelButton($profile_uri)
       ->addSubmitButton($submit);
   }
 
 }
diff --git a/src/applications/people/controller/PhabricatorPeopleRenameController.php b/src/applications/people/controller/PhabricatorPeopleRenameController.php
index a785f4d249..873ddeeb5f 100644
--- a/src/applications/people/controller/PhabricatorPeopleRenameController.php
+++ b/src/applications/people/controller/PhabricatorPeopleRenameController.php
@@ -1,117 +1,122 @@
 <?php
 
 final class PhabricatorPeopleRenameController
   extends PhabricatorPeopleController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer($admin)
       ->withIDs(array($this->id))
       ->executeOne();
     if (!$user) {
       return new Aphront404Response();
     }
 
     $profile_uri = '/p/'.$user->getUsername().'/';
 
+    id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $admin,
+      $request,
+      $profile_uri);
+
     $errors = array();
 
     $v_username = $user->getUsername();
     $e_username = true;
     if ($request->isFormPost()) {
       $v_username = $request->getStr('username');
 
 
       if (!strlen($v_username)) {
         $e_username = pht('Required');
         $errors[] = pht('New username is required.');
       } else if ($v_username == $user->getUsername()) {
         $e_username = pht('Invalid');
         $errors[] = pht('New username must be different from old username.');
       } else if (!PhabricatorUser::validateUsername($v_username)) {
         $e_username = pht('Invalid');
         $errors[] = PhabricatorUser::describeValidUsername();
       }
 
       if (!$errors) {
         try {
           id(new PhabricatorUserEditor())
             ->setActor($admin)
             ->changeUsername($user, $v_username);
 
           $new_uri = '/p/'.$v_username.'/';
 
           return id(new AphrontRedirectResponse())->setURI($new_uri);
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $e_username = pht('Not Unique');
           $errors[] = pht('Another user already has that username.');
         }
       }
     }
 
     $inst1 = pht(
       'Be careful when renaming users!');
 
     $inst2 = pht(
       'The old username will no longer be tied to the user, so anything '.
       'which uses it (like old commit messages) will no longer associate '.
       'correctly. (And, if you give a user a username which some other user '.
       'used to have, username lookups will begin returning the wrong user.)');
 
     $inst3 = pht(
       'It is generally safe to rename newly created users (and test users '.
       'and so on), but less safe to rename established users and unsafe to '.
       'reissue a username.');
 
     $inst4 = pht(
       'Users who rely on password authentication will need to reset their '.
       'password after their username is changed (their username is part of '.
       'the salt in the password hash).');
 
     $inst5 = pht(
       'The user will receive an email notifying them that you changed their '.
       'username, with instructions for logging in and resetting their '.
       'password if necessary.');
 
     $form = id(new AphrontFormView())
       ->setUser($admin)
       ->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Old Username'))
           ->setValue($user->getUsername()))
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('New Username'))
           ->setValue($v_username)
           ->setName('username')
           ->setError($e_username));
 
     if ($errors) {
       $errors = id(new AphrontErrorView())->setErrors($errors);
     }
 
     return $this->newDialog()
       ->setWidth(AphrontDialogView::WIDTH_FORM)
       ->setTitle(pht('Change Username'))
       ->appendChild($errors)
       ->appendParagraph($inst1)
       ->appendParagraph($inst2)
       ->appendParagraph($inst3)
       ->appendParagraph($inst4)
       ->appendParagraph($inst5)
       ->appendParagraph(null)
       ->appendChild($form->buildLayoutView())
       ->addSubmitButton(pht('Rename User'))
       ->addCancelButton($profile_uri);
   }
 
 }
diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
index df050005c1..8666cfc426 100644
--- a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
+++ b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
@@ -1,122 +1,127 @@
 <?php
 
 final class PhabricatorSettingsPanelConduit
   extends PhabricatorSettingsPanel {
 
   public function isEditableByAdministrators() {
     return true;
   }
 
   public function getPanelKey() {
     return 'conduit';
   }
 
   public function getPanelName() {
     return pht('Conduit Certificate');
   }
 
   public function getPanelGroup() {
     return pht('Authentication');
   }
 
   public function processRequest(AphrontRequest $request) {
     $user = $this->getUser();
     $viewer = $request->getUser();
 
+    id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $viewer,
+      $request,
+      '/settings/');
+
     if ($request->isFormPost()) {
       if (!$request->isDialogFormPost()) {
         $dialog = new AphrontDialogView();
         $dialog->setUser($viewer);
         $dialog->setTitle(pht('Really regenerate session?'));
         $dialog->setSubmitURI($this->getPanelURI());
         $dialog->addSubmitButton(pht('Regenerate'));
         $dialog->addCancelbutton($this->getPanelURI());
         $dialog->appendChild(phutil_tag('p', array(), pht(
           'Really destroy the old certificate? Any established '.
           'sessions will be terminated.')));
 
         return id(new AphrontDialogResponse())
           ->setDialog($dialog);
       }
 
       $sessions = id(new PhabricatorAuthSessionQuery())
         ->setViewer($user)
         ->withIdentityPHIDs(array($user->getPHID()))
         ->withSessionTypes(array(PhabricatorAuthSession::TYPE_CONDUIT))
         ->execute();
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       // This implicitly regenerates the certificate.
       $user->setConduitCertificate(null);
       $user->save();
       return id(new AphrontRedirectResponse())
         ->setURI($this->getPanelURI('?regenerated=true'));
     }
 
     if ($request->getStr('regenerated')) {
       $notice = new AphrontErrorView();
       $notice->setSeverity(AphrontErrorView::SEVERITY_NOTICE);
       $notice->setTitle(pht('Certificate Regenerated'));
       $notice->appendChild(phutil_tag(
         'p',
         array(),
         pht('Your old certificate has been destroyed and you have been issued '.
         'a new certificate. Sessions established under the old certificate '.
         'are no longer valid.')));
       $notice = $notice->render();
     } else {
       $notice = null;
     }
 
     Javelin::initBehavior('select-on-click');
 
     $cert_form = new AphrontFormView();
     $cert_form
       ->setUser($viewer)
       ->appendChild(phutil_tag(
         'p',
         array('class' => 'aphront-form-instructions'),
         pht('This certificate allows you to authenticate over Conduit, '.
           'the Phabricator API. Normally, you just run %s to install it.',
           phutil_tag('tt', array(), 'arc install-certificate'))))
       ->appendChild(
         id(new AphrontFormTextAreaControl())
           ->setLabel(pht('Certificate'))
           ->setHeight(AphrontFormTextAreaControl::HEIGHT_SHORT)
           ->setReadonly(true)
           ->setSigil('select-on-click')
           ->setValue($user->getConduitCertificate()));
 
     $cert_form = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Arcanist Certificate'))
       ->setForm($cert_form);
 
     $regen_instruction = pht('You can regenerate this certificate, which '.
       'will invalidate the old certificate and create a new one.');
 
     $regen_form = new AphrontFormView();
     $regen_form
       ->setUser($viewer)
       ->setAction($this->getPanelURI())
       ->setWorkflow(true)
       ->appendChild(phutil_tag(
         'p',
         array('class' => 'aphront-form-instructions'),
         $regen_instruction))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Regenerate Certificate')));
 
     $regen_form = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Regenerate Certificate'))
       ->setForm($regen_form);
 
     return array(
       $notice,
       $cert_form,
       $regen_form,
     );
   }
 }
diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelEmailAddresses.php b/src/applications/settings/panel/PhabricatorSettingsPanelEmailAddresses.php
index 9a8d834178..14ad5c04ac 100644
--- a/src/applications/settings/panel/PhabricatorSettingsPanelEmailAddresses.php
+++ b/src/applications/settings/panel/PhabricatorSettingsPanelEmailAddresses.php
@@ -1,368 +1,373 @@
 <?php
 
 final class PhabricatorSettingsPanelEmailAddresses
   extends PhabricatorSettingsPanel {
 
   public function getPanelKey() {
     return 'email';
   }
 
   public function getPanelName() {
     return pht('Email Addresses');
   }
 
   public function getPanelGroup() {
     return pht('Email');
   }
 
   public function processRequest(AphrontRequest $request) {
     $user = $request->getUser();
     $editable = PhabricatorEnv::getEnvConfig('account.editable');
 
     $uri = $request->getRequestURI();
     $uri->setQueryParams(array());
 
     if ($editable) {
       $new = $request->getStr('new');
       if ($new) {
         return $this->returnNewAddressResponse($request, $uri, $new);
       }
 
       $delete = $request->getInt('delete');
       if ($delete) {
         return $this->returnDeleteAddressResponse($request, $uri, $delete);
       }
     }
 
     $verify = $request->getInt('verify');
     if ($verify) {
       return $this->returnVerifyAddressResponse($request, $uri, $verify);
     }
 
     $primary = $request->getInt('primary');
     if ($primary) {
       return $this->returnPrimaryAddressResponse($request, $uri, $primary);
     }
 
     $emails = id(new PhabricatorUserEmail())->loadAllWhere(
       'userPHID = %s ORDER BY address',
       $user->getPHID());
 
     $rowc = array();
     $rows = array();
     foreach ($emails as $email) {
 
       $button_verify = javelin_tag(
         'a',
         array(
           'class' => 'button small grey',
           'href'  => $uri->alter('verify', $email->getID()),
           'sigil' => 'workflow',
         ),
         pht('Verify'));
 
       $button_make_primary = javelin_tag(
         'a',
         array(
           'class' => 'button small grey',
           'href'  => $uri->alter('primary', $email->getID()),
           'sigil' => 'workflow',
         ),
         pht('Make Primary'));
 
       $button_remove = javelin_tag(
         'a',
         array(
           'class'   => 'button small grey',
           'href'    => $uri->alter('delete', $email->getID()),
           'sigil'   => 'workflow'
         ),
         pht('Remove'));
 
       $button_primary = phutil_tag(
         'a',
         array(
           'class' => 'button small disabled',
         ),
         pht('Primary'));
 
       if (!$email->getIsVerified()) {
         $action = $button_verify;
       } else if ($email->getIsPrimary()) {
         $action = $button_primary;
       } else {
         $action = $button_make_primary;
       }
 
       if ($email->getIsPrimary()) {
         $remove = $button_primary;
         $rowc[] = 'highlighted';
       } else {
         $remove = $button_remove;
         $rowc[] = null;
       }
 
       $rows[] = array(
         $email->getAddress(),
         $action,
         $remove,
       );
     }
 
     $table = new AphrontTableView($rows);
     $table->setHeaders(
       array(
         pht('Email'),
         pht('Status'),
         pht('Remove'),
       ));
     $table->setColumnClasses(
       array(
         'wide',
         'action',
         'action',
       ));
     $table->setRowClasses($rowc);
     $table->setColumnVisibility(
       array(
         true,
         true,
         $editable,
       ));
 
     $view = new PHUIObjectBoxView();
     $header = new PHUIHeaderView();
     $header->setHeader(pht('Email Addresses'));
 
     if ($editable) {
       $icon = id(new PHUIIconView())
         ->setSpriteSheet(PHUIIconView::SPRITE_ICONS)
         ->setSpriteIcon('new');
 
       $button = new PHUIButtonView();
       $button->setText(pht('Add New Address'));
       $button->setTag('a');
       $button->setHref($uri->alter('new', 'true'));
       $button->setIcon($icon);
       $button->addSigil('workflow');
       $header->addActionLink($button);
     }
     $view->setHeader($header);
     $view->appendChild($table);
 
     return $view;
   }
 
   private function returnNewAddressResponse(
     AphrontRequest $request,
     PhutilURI $uri,
     $new) {
 
     $user = $request->getUser();
 
     $e_email = true;
     $email   = null;
     $errors  = array();
     if ($request->isDialogFormPost()) {
       $email = trim($request->getStr('email'));
 
       if ($new == 'verify') {
         // The user clicked "Done" from the "an email has been sent" dialog.
         return id(new AphrontReloadResponse())->setURI($uri);
       }
 
       PhabricatorSystemActionEngine::willTakeAction(
         array($user->getPHID()),
         new PhabricatorSettingsAddEmailAction(),
         1);
 
       if (!strlen($email)) {
         $e_email = pht('Required');
         $errors[] = pht('Email is required.');
       } else if (!PhabricatorUserEmail::isValidAddress($email)) {
         $e_email = pht('Invalid');
         $errors[] = PhabricatorUserEmail::describeValidAddresses();
       } else if (!PhabricatorUserEmail::isAllowedAddress($email)) {
         $e_email = pht('Disallowed');
         $errors[] = PhabricatorUserEmail::describeAllowedAddresses();
       }
 
       if (!$errors) {
         $object = id(new PhabricatorUserEmail())
           ->setAddress($email)
           ->setIsVerified(0);
 
         try {
 
           id(new PhabricatorUserEditor())
             ->setActor($user)
             ->addEmail($user, $object);
 
           $object->sendVerificationEmail($user);
 
           $dialog = id(new AphrontDialogView())
             ->setUser($user)
             ->addHiddenInput('new',  'verify')
             ->setTitle(pht('Verification Email Sent'))
             ->appendChild(phutil_tag('p', array(), pht(
               'A verification email has been sent. Click the link in the '.
               'email to verify your address.')))
             ->setSubmitURI($uri)
             ->addSubmitButton(pht('Done'));
 
           return id(new AphrontDialogResponse())->setDialog($dialog);
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $email = pht('Duplicate');
           $errors[] = pht('Another user already has this email.');
         }
       }
     }
 
     if ($errors) {
       $errors = id(new AphrontErrorView())
         ->setErrors($errors);
     }
 
     $form = id(new PHUIFormLayoutView())
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Email'))
           ->setName('email')
           ->setValue($email)
           ->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
           ->setError($e_email));
 
     $dialog = id(new AphrontDialogView())
       ->setUser($user)
       ->addHiddenInput('new', 'true')
       ->setTitle(pht('New Address'))
       ->appendChild($errors)
       ->appendChild($form)
       ->addSubmitButton(pht('Save'))
       ->addCancelButton($uri);
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
   private function returnDeleteAddressResponse(
     AphrontRequest $request,
     PhutilURI $uri,
     $email_id) {
 
     $user = $request->getUser();
 
     // NOTE: You can only delete your own email addresses, and you can not
     // delete your primary address.
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'id = %d AND userPHID = %s AND isPrimary = 0',
       $email_id,
       $user->getPHID());
 
     if (!$email) {
       return new Aphront404Response();
     }
 
     if ($request->isFormPost()) {
 
       id(new PhabricatorUserEditor())
         ->setActor($user)
         ->removeEmail($user, $email);
 
       return id(new AphrontRedirectResponse())->setURI($uri);
     }
 
     $address = $email->getAddress();
 
     $dialog = id(new AphrontDialogView())
       ->setUser($user)
       ->addHiddenInput('delete', $email_id)
       ->setTitle(pht("Really delete address '%s'?", $address))
       ->appendChild(phutil_tag('p', array(), pht(
         'Are you sure you want to delete this address? You will no '.
         'longer be able to use it to login.')))
       ->addSubmitButton(pht('Delete'))
       ->addCancelButton($uri);
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
   private function returnVerifyAddressResponse(
     AphrontRequest $request,
     PhutilURI $uri,
     $email_id) {
 
     $user = $request->getUser();
 
     // NOTE: You can only send more email for your unverified addresses.
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'id = %d AND userPHID = %s AND isVerified = 0',
       $email_id,
       $user->getPHID());
 
     if (!$email) {
       return new Aphront404Response();
     }
 
     if ($request->isFormPost()) {
       $email->sendVerificationEmail($user);
       return id(new AphrontRedirectResponse())->setURI($uri);
     }
 
     $address = $email->getAddress();
 
     $dialog = id(new AphrontDialogView())
       ->setUser($user)
       ->addHiddenInput('verify', $email_id)
       ->setTitle(pht("Send Another Verification Email?"))
       ->appendChild(phutil_tag('p', array(), pht(
         'Send another copy of the verification email to %s?',
         $address)))
       ->addSubmitButton(pht('Send Email'))
       ->addCancelButton($uri);
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
   private function returnPrimaryAddressResponse(
     AphrontRequest $request,
     PhutilURI $uri,
     $email_id) {
 
     $user = $request->getUser();
 
+    $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $user,
+      $request,
+      $this->getPanelURI());
+
     // NOTE: You can only make your own verified addresses primary.
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'id = %d AND userPHID = %s AND isVerified = 1 AND isPrimary = 0',
       $email_id,
       $user->getPHID());
 
     if (!$email) {
       return new Aphront404Response();
     }
 
     if ($request->isFormPost()) {
 
       id(new PhabricatorUserEditor())
         ->setActor($user)
         ->changePrimaryEmail($user, $email);
 
       return id(new AphrontRedirectResponse())->setURI($uri);
     }
 
     $address = $email->getAddress();
 
     $dialog = id(new AphrontDialogView())
       ->setUser($user)
       ->addHiddenInput('primary', $email_id)
       ->setTitle(pht("Change primary email address?"))
       ->appendChild(phutil_tag('p', array(), pht(
         'If you change your primary address, Phabricator will send'.
           ' all email to %s.',
         $address)))
       ->addSubmitButton(pht('Change Primary Address'))
       ->addCancelButton($uri);
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
 }
diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php b/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
index bc229fbaab..daccdd28be 100644
--- a/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
+++ b/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
@@ -1,182 +1,187 @@
 <?php
 
 final class PhabricatorSettingsPanelPassword
   extends PhabricatorSettingsPanel {
 
   public function getPanelKey() {
     return 'password';
   }
 
   public function getPanelName() {
     return pht('Password');
   }
 
   public function getPanelGroup() {
     return pht('Authentication');
   }
 
   public function isEnabled() {
     // There's no sense in showing a change password panel if the user
     // can't change their password...
 
     if (!PhabricatorEnv::getEnvConfig('account.editable')) {
       return false;
     }
 
     // ...or this install doesn't support password authentication at all.
 
     if (!PhabricatorAuthProviderPassword::getPasswordProvider()) {
       return false;
     }
 
     return true;
   }
 
   public function processRequest(AphrontRequest $request) {
     $user = $request->getUser();
 
+    $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $user,
+      $request,
+      '/settings/');
+
     $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
     $min_len = (int)$min_len;
 
     // NOTE: To change your password, you need to prove you own the account,
     // either by providing the old password or by carrying a token to
     // the workflow from a password reset email.
 
     $token = $request->getStr('token');
 
     $valid_token = false;
     if ($token) {
       $email_address = $request->getStr('email');
       $email = id(new PhabricatorUserEmail())->loadOneWhere(
         'address = %s',
         $email_address);
       if ($email) {
         $valid_token = $user->validateEmailToken($email, $token);
       }
     }
 
     $e_old = true;
     $e_new = true;
     $e_conf = true;
 
     $errors = array();
     if ($request->isFormPost()) {
       if (!$valid_token) {
         $envelope = new PhutilOpaqueEnvelope($request->getStr('old_pw'));
         if (!$user->comparePassword($envelope)) {
           $errors[] = pht('The old password you entered is incorrect.');
           $e_old = pht('Invalid');
         }
       }
 
       $pass = $request->getStr('new_pw');
       $conf = $request->getStr('conf_pw');
 
       if (strlen($pass) < $min_len) {
         $errors[] = pht('Your new password is too short.');
         $e_new = pht('Too Short');
       } else if ($pass !== $conf) {
         $errors[] = pht('New password and confirmation do not match.');
         $e_conf = pht('Invalid');
       } else if (PhabricatorCommonPasswords::isCommonPassword($pass)) {
         $e_new = pht('Very Weak');
         $e_conf = pht('Very Weak');
         $errors[] = pht(
           'Your new password is very weak: it is one of the most common '.
           'passwords in use. Choose a stronger password.');
       }
 
       if (!$errors) {
         // This write is unguarded because the CSRF token has already
         // been checked in the call to $request->isFormPost() and
         // the CSRF token depends on the password hash, so when it
         // is changed here the CSRF token check will fail.
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
           $envelope = new PhutilOpaqueEnvelope($pass);
           id(new PhabricatorUserEditor())
             ->setActor($user)
             ->changePassword($user, $envelope);
 
         unset($unguarded);
 
         if ($valid_token) {
           // If this is a password set/reset, kick the user to the home page
           // after we update their account.
           $next = '/';
         } else {
           $next = $this->getPanelURI('?saved=true');
         }
 
         return id(new AphrontRedirectResponse())->setURI($next);
       }
     }
 
     $hash_envelope = new PhutilOpaqueEnvelope($user->getPasswordHash());
     if (strlen($hash_envelope->openEnvelope())) {
       if (PhabricatorPasswordHasher::canUpgradeHash($hash_envelope)) {
         $errors[] = pht(
           'The strength of your stored password hash can be upgraded. '.
           'To upgrade, either: log out and log in using your password; or '.
           'change your password.');
       }
     }
 
     $len_caption = null;
     if ($min_len) {
       $len_caption = pht('Minimum password length: %d characters.', $min_len);
     }
 
     $form = new AphrontFormView();
     $form
       ->setUser($user)
       ->addHiddenInput('token', $token);
 
     if (!$valid_token) {
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Old Password'))
           ->setError($e_old)
           ->setName('old_pw'));
     }
 
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('New Password'))
           ->setError($e_new)
           ->setName('new_pw'));
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Confirm Password'))
           ->setCaption($len_caption)
           ->setError($e_conf)
           ->setName('conf_pw'));
     $form
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Change Password')));
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Current Algorithm'))
         ->setValue(PhabricatorPasswordHasher::getCurrentAlgorithmName(
           new PhutilOpaqueEnvelope($user->getPasswordHash()))));
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Best Available Algorithm'))
         ->setValue(PhabricatorPasswordHasher::getBestAlgorithmName()));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Change Password'))
       ->setFormSaved($request->getStr('saved'))
       ->setFormErrors($errors)
       ->setForm($form);
 
     return array(
       $form_box,
     );
   }
 }
diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelSSHKeys.php b/src/applications/settings/panel/PhabricatorSettingsPanelSSHKeys.php
index 8ab4a4da6a..1f3418ed72 100644
--- a/src/applications/settings/panel/PhabricatorSettingsPanelSSHKeys.php
+++ b/src/applications/settings/panel/PhabricatorSettingsPanelSSHKeys.php
@@ -1,418 +1,424 @@
 <?php
 
 final class PhabricatorSettingsPanelSSHKeys
   extends PhabricatorSettingsPanel {
 
   public function isEditableByAdministrators() {
     return true;
   }
 
   public function getPanelKey() {
     return 'ssh';
   }
 
   public function getPanelName() {
     return pht('SSH Public Keys');
   }
 
   public function getPanelGroup() {
     return pht('Authentication');
   }
 
   public function isEnabled() {
     return true;
   }
 
   public function processRequest(AphrontRequest $request) {
     $viewer = $request->getUser();
     $user = $this->getUser();
 
     $generate = $request->getStr('generate');
     if ($generate) {
       return $this->processGenerate($request);
     }
 
     $edit = $request->getStr('edit');
     $delete = $request->getStr('delete');
     if (!$edit && !$delete) {
       return $this->renderKeyListView($request);
     }
 
     $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
       $viewer,
       $request,
       $this->getPanelURI());
 
     $id = nonempty($edit, $delete);
 
     if ($id && is_numeric($id)) {
       // NOTE: This prevents editing/deleting of keys not owned by the user.
       $key = id(new PhabricatorUserSSHKey())->loadOneWhere(
         'userPHID = %s AND id = %d',
         $user->getPHID(),
         (int)$id);
       if (!$key) {
         return new Aphront404Response();
       }
     } else {
       $key = new PhabricatorUserSSHKey();
       $key->setUserPHID($user->getPHID());
     }
 
     if ($delete) {
       return $this->processDelete($request, $key);
     }
 
     $e_name = true;
     $e_key = true;
     $errors = array();
     $entire_key = $key->getEntireKey();
     if ($request->isFormPost()) {
       $key->setName($request->getStr('name'));
       $entire_key = $request->getStr('key');
 
       if (!strlen($entire_key)) {
         $errors[] = pht('You must provide an SSH Public Key.');
         $e_key = pht('Required');
       } else {
 
         try {
           list($type, $body, $comment) = self::parsePublicKey($entire_key);
 
           $key->setKeyType($type);
           $key->setKeyBody($body);
           $key->setKeyHash(md5($body));
           $key->setKeyComment($comment);
 
           $e_key = null;
         } catch (Exception $ex) {
           $e_key = pht('Invalid');
           $errors[] = $ex->getMessage();
         }
       }
 
       if (!strlen($key->getName())) {
         $errors[] = pht('You must name this public key.');
         $e_name = pht('Required');
       } else {
         $e_name = null;
       }
 
       if (!$errors) {
         try {
           $key->save();
           return id(new AphrontRedirectResponse())
             ->setURI($this->getPanelURI());
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $e_key = pht('Duplicate');
           $errors[] = pht('This public key is already associated with a user '.
                       'account.');
         }
       }
     }
 
     $is_new = !$key->getID();
 
     if ($is_new) {
       $header = pht('Add New SSH Public Key');
       $save = pht('Add Key');
     } else {
       $header = pht('Edit SSH Public Key');
       $save   = pht('Save Changes');
     }
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->addHiddenInput('edit', $is_new ? 'true' : $key->getID())
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Name'))
           ->setName('name')
           ->setValue($key->getName())
           ->setError($e_name))
       ->appendChild(
         id(new AphrontFormTextAreaControl())
           ->setLabel(pht('Public Key'))
           ->setName('key')
           ->setValue($entire_key)
           ->setError($e_key))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->addCancelButton($this->getPanelURI())
           ->setValue($save));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($header)
       ->setFormErrors($errors)
       ->setForm($form);
 
     return $form_box;
   }
 
   private function renderKeyListView(AphrontRequest $request) {
     $user = $this->getUser();
     $viewer = $request->getUser();
 
     $keys = id(new PhabricatorUserSSHKey())->loadAllWhere(
       'userPHID = %s',
       $user->getPHID());
 
     $rows = array();
     foreach ($keys as $key) {
       $rows[] = array(
         phutil_tag(
           'a',
           array(
             'href' => $this->getPanelURI('?edit='.$key->getID()),
           ),
           $key->getName()),
         $key->getKeyComment(),
         $key->getKeyType(),
         phabricator_date($key->getDateCreated(), $viewer),
         phabricator_time($key->getDateCreated(), $viewer),
         javelin_tag(
           'a',
           array(
             'href' => $this->getPanelURI('?delete='.$key->getID()),
             'class' => 'small grey button',
             'sigil' => 'workflow',
           ),
           pht('Delete')),
       );
     }
 
     $table = new AphrontTableView($rows);
     $table->setNoDataString(pht("You haven't added any SSH Public Keys."));
     $table->setHeaders(
       array(
         pht('Name'),
         pht('Comment'),
         pht('Type'),
         pht('Created'),
         pht('Time'),
         '',
       ));
     $table->setColumnClasses(
       array(
         'wide pri',
         '',
         '',
         '',
         'right',
         'action',
       ));
 
     $panel = new PHUIObjectBoxView();
     $header = new PHUIHeaderView();
 
     $upload_icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_ICONS)
       ->setSpriteIcon('upload');
     $upload_button = id(new PHUIButtonView())
       ->setText(pht('Upload Public Key'))
       ->setHref($this->getPanelURI('?edit=true'))
       ->setTag('a')
       ->setIcon($upload_icon);
 
     try {
       PhabricatorSSHKeyGenerator::assertCanGenerateKeypair();
       $can_generate = true;
     } catch (Exception $ex) {
       $can_generate = false;
     }
 
     $generate_icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_ICONS)
       ->setSpriteIcon('lock');
     $generate_button = id(new PHUIButtonView())
       ->setText(pht('Generate Keypair'))
       ->setHref($this->getPanelURI('?generate=true'))
       ->setTag('a')
       ->setWorkflow(true)
       ->setDisabled(!$can_generate)
       ->setIcon($generate_icon);
 
     $header->setHeader(pht('SSH Public Keys'));
     $header->addActionLink($generate_button);
     $header->addActionLink($upload_button);
 
     $panel->setHeader($header);
     $panel->appendChild($table);
 
     return $panel;
   }
 
   private function processDelete(
     AphrontRequest $request,
     PhabricatorUserSSHKey $key) {
 
     $viewer = $request->getUser();
     $user = $this->getUser();
 
     $name = phutil_tag('strong', array(), $key->getName());
 
     if ($request->isDialogFormPost()) {
       $key->delete();
       return id(new AphrontReloadResponse())
         ->setURI($this->getPanelURI());
     }
 
     $dialog = id(new AphrontDialogView())
       ->setUser($viewer)
       ->addHiddenInput('delete', $key->getID())
       ->setTitle(pht('Really delete SSH Public Key?'))
       ->appendChild(phutil_tag('p', array(), pht(
         'The key "%s" will be permanently deleted, and you will not longer be '.
           'able to use the corresponding private key to authenticate.',
         $name)))
       ->addSubmitButton(pht('Delete Public Key'))
       ->addCancelButton($this->getPanelURI());
 
     return id(new AphrontDialogResponse())
       ->setDialog($dialog);
   }
 
   private function processGenerate(AphrontRequest $request) {
     $user = $this->getUser();
     $viewer = $request->getUser();
 
+    $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
+      $viewer,
+      $request,
+      $this->getPanelURI());
+
+
     $is_self = ($user->getPHID() == $viewer->getPHID());
 
     if ($request->isFormPost()) {
       $keys = PhabricatorSSHKeyGenerator::generateKeypair();
       list($public_key, $private_key) = $keys;
 
       $file = PhabricatorFile::buildFromFileDataOrHash(
         $private_key,
         array(
           'name' => 'id_rsa_phabricator.key',
           'ttl' => time() + (60 * 10),
           'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
         ));
 
       list($type, $body, $comment) = self::parsePublicKey($public_key);
 
       $key = id(new PhabricatorUserSSHKey())
         ->setUserPHID($user->getPHID())
         ->setName('id_rsa_phabricator')
         ->setKeyType($type)
         ->setKeyBody($body)
         ->setKeyHash(md5($body))
         ->setKeyComment(pht('Generated'))
         ->save();
 
       // NOTE: We're disabling workflow on submit so the download works. We're
       // disabling workflow on cancel so the page reloads, showing the new
       // key.
 
       if ($is_self) {
         $what_happened = pht(
           'The public key has been associated with your Phabricator '.
           'account. Use the button below to download the private key.');
       } else {
         $what_happened = pht(
           'The public key has been associated with the %s account. '.
           'Use the button below to download the private key.',
           phutil_tag('strong', array(), $user->getUsername()));
       }
 
       $dialog = id(new AphrontDialogView())
         ->setTitle(pht('Download Private Key'))
         ->setUser($viewer)
         ->setDisableWorkflowOnCancel(true)
         ->setDisableWorkflowOnSubmit(true)
         ->setSubmitURI($file->getDownloadURI())
         ->appendParagraph(
           pht(
             'Successfully generated a new keypair.'))
         ->appendParagraph($what_happened)
         ->appendParagraph(
           pht(
             'After you download the private key, it will be destroyed. '.
             'You will not be able to retrieve it if you lose your copy.'))
         ->addSubmitButton(pht('Download Private Key'))
         ->addCancelButton($this->getPanelURI(), pht('Done'));
 
       return id(new AphrontDialogResponse())
         ->setDialog($dialog);
     }
 
     $dialog = id(new AphrontDialogView())
       ->setUser($viewer)
       ->addCancelButton($this->getPanelURI());
 
     try {
       PhabricatorSSHKeyGenerator::assertCanGenerateKeypair();
 
       if ($is_self) {
         $explain = pht(
           'This will generate an SSH keypair, associate the public key '.
           'with your account, and let you download the private key.');
       } else {
         $explain = pht(
           'This will generate an SSH keypair, associate the public key with '.
           'the %s account, and let you download the private key.',
           phutil_tag('strong', array(), $user->getUsername()));
       }
 
       $dialog
         ->addHiddenInput('generate', true)
         ->setTitle(pht('Generate New Keypair'))
         ->appendParagraph($explain)
         ->appendParagraph(
           pht(
             "Phabricator will not retain a copy of the private key."))
         ->addSubmitButton(pht('Generate Keypair'));
     } catch (Exception $ex) {
       $dialog
         ->setTitle(pht('Unable to Generate Keys'))
         ->appendParagraph($ex->getMessage());
     }
 
     return id(new AphrontDialogResponse())
       ->setDialog($dialog);
   }
 
   private static function parsePublicKey($entire_key) {
     $parts = str_replace("\n", '', trim($entire_key));
     $parts = preg_split('/\s+/', $parts);
 
     if (count($parts) == 2) {
       $parts[] = ''; // Add an empty comment part.
     } else if (count($parts) == 3) {
       // This is the expected case.
     } else {
       if (preg_match('/private\s*key/i', $entire_key)) {
         // Try to give the user a better error message if it looks like
         // they uploaded a private key.
         throw new Exception(
           pht('Provide your public key, not your private key!'));
       } else {
         throw new Exception(
           pht('Provided public key is not properly formatted.'));
       }
     }
 
     list($type, $body, $comment) = $parts;
 
     $recognized_keys = array(
       'ssh-dsa',
       'ssh-dss',
       'ssh-rsa',
       'ecdsa-sha2-nistp256',
       'ecdsa-sha2-nistp384',
       'ecdsa-sha2-nistp521',
     );
 
     if (!in_array($type, $recognized_keys)) {
       $type_list = implode(', ', $recognized_keys);
       throw new Exception(
         pht(
           'Public key type should be one of: %s',
           $type_list));
     }
 
     return array($type, $body, $comment);
   }
 
 }