diff --git a/src/applications/auth/controller/PhabricatorAuthRegisterController.php b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
index 9e1aef592c..0562a4242c 100644
--- a/src/applications/auth/controller/PhabricatorAuthRegisterController.php
+++ b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
@@ -1,743 +1,749 @@
 <?php
 
 final class PhabricatorAuthRegisterController
   extends PhabricatorAuthController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $account_key = $request->getURIData('akey');
 
     if ($request->getUser()->isLoggedIn()) {
       return id(new AphrontRedirectResponse())->setURI('/');
     }
 
     $is_setup = false;
     if (strlen($account_key)) {
       $result = $this->loadAccountForRegistrationOrLinking($account_key);
       list($account, $provider, $response) = $result;
       $is_default = false;
     } else if ($this->isFirstTimeSetup()) {
-      list($account, $provider, $response) = $this->loadSetupAccount();
+      $account = null;
+      $provider = null;
+      $response = null;
       $is_default = true;
       $is_setup = true;
     } else {
       list($account, $provider, $response) = $this->loadDefaultAccount();
       $is_default = true;
     }
 
     if ($response) {
       return $response;
     }
 
     $invite = $this->loadInvite();
 
-    if (!$provider->shouldAllowRegistration()) {
-      if ($invite) {
-        // If the user has an invite, we allow them to register with any
-        // provider, even a login-only provider.
-      } else {
-        // TODO: This is a routine error if you click "Login" on an external
-        // auth source which doesn't allow registration. The error should be
-        // more tailored.
+    if (!$is_setup) {
+      if (!$provider->shouldAllowRegistration()) {
+        if ($invite) {
+          // If the user has an invite, we allow them to register with any
+          // provider, even a login-only provider.
+        } else {
+          // TODO: This is a routine error if you click "Login" on an external
+          // auth source which doesn't allow registration. The error should be
+          // more tailored.
 
-        return $this->renderError(
-          pht(
-            'The account you are attempting to register with uses an '.
-            'authentication provider ("%s") which does not allow '.
-            'registration. An administrator may have recently disabled '.
-            'registration with this provider.',
-            $provider->getProviderName()));
+          return $this->renderError(
+            pht(
+              'The account you are attempting to register with uses an '.
+              'authentication provider ("%s") which does not allow '.
+              'registration. An administrator may have recently disabled '.
+              'registration with this provider.',
+              $provider->getProviderName()));
+        }
       }
     }
 
     $errors = array();
 
     $user = new PhabricatorUser();
 
-    $default_username = $account->getUsername();
-    $default_realname = $account->getRealName();
+    if ($is_setup) {
+      $default_username = null;
+      $default_realname = null;
+      $default_email = null;
+    } else {
+      $default_username = $account->getUsername();
+      $default_realname = $account->getRealName();
+      $default_email = $account->getEmail();
+    }
 
     $account_type = PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT;
     $content_source = PhabricatorContentSource::newFromRequest($request);
 
-    $default_email = $account->getEmail();
-
     if ($invite) {
       $default_email = $invite->getEmailAddress();
     }
 
     if ($default_email !== null) {
       if (!PhabricatorUserEmail::isValidAddress($default_email)) {
         $errors[] = pht(
           'The email address associated with this external account ("%s") is '.
           'not a valid email address and can not be used to register a '.
           'Phabricator account. Choose a different, valid address.',
           phutil_tag('strong', array(), $default_email));
         $default_email = null;
       }
     }
 
     if ($default_email !== null) {
       // We should bypass policy here because e.g. limiting an application use
       // to a subset of users should not allow the others to overwrite
       // configured application emails.
       $application_email = id(new PhabricatorMetaMTAApplicationEmailQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withAddresses(array($default_email))
         ->executeOne();
       if ($application_email) {
         $errors[] = pht(
           'The email address associated with this account ("%s") is '.
           'already in use by an application and can not be used to '.
           'register a new Phabricator account. Choose a different, valid '.
           'address.',
           phutil_tag('strong', array(), $default_email));
         $default_email = null;
       }
     }
 
     $show_existing = null;
     if ($default_email !== null) {
       // If the account source provided an email, but it's not allowed by
       // the configuration, roadblock the user. Previously, we let the user
       // pick a valid email address instead, but this does not align well with
       // user expectation and it's not clear the cases it enables are valuable.
       // See discussion in T3472.
       if (!PhabricatorUserEmail::isAllowedAddress($default_email)) {
         $debug_email = new PHUIInvisibleCharacterView($default_email);
         return $this->renderError(
           array(
             pht(
               'The account you are attempting to register with has an invalid '.
               'email address (%s). This Phabricator install only allows '.
               'registration with specific email addresses:',
               $debug_email),
             phutil_tag('br'),
             phutil_tag('br'),
             PhabricatorUserEmail::describeAllowedAddresses(),
           ));
       }
 
       // If the account source provided an email, but another account already
       // has that email, just pretend we didn't get an email.
       if ($default_email !== null) {
         $same_email = id(new PhabricatorUserEmail())->loadOneWhere(
           'address = %s',
           $default_email);
         if ($same_email) {
           if ($invite) {
             // We're allowing this to continue. The fact that we loaded the
             // invite means that the address is nonprimary and unverified and
             // we're OK to steal it.
           } else {
             $show_existing = $default_email;
             $default_email = null;
           }
         }
       }
     }
 
     if ($show_existing !== null) {
       if (!$request->getInt('phase')) {
         return $this->newDialog()
           ->setTitle(pht('Email Address Already in Use'))
           ->addHiddenInput('phase', 1)
           ->appendParagraph(
             pht(
               'You are creating a new Phabricator account linked to an '.
               'existing external account from outside Phabricator.'))
           ->appendParagraph(
             pht(
               'The email address ("%s") associated with the external account '.
               'is already in use by an existing Phabricator account. Multiple '.
               'Phabricator accounts may not have the same email address, so '.
               'you can not use this email address to register a new '.
               'Phabricator account.',
               phutil_tag('strong', array(), $show_existing)))
           ->appendParagraph(
             pht(
               'If you want to register a new account, continue with this '.
               'registration workflow and choose a new, unique email address '.
               'for the new account.'))
           ->appendParagraph(
             pht(
               'If you want to link an existing Phabricator account to this '.
               'external account, do not continue. Instead: log in to your '.
               'existing account, then go to "Settings" and link the account '.
               'in the "External Accounts" panel.'))
           ->appendParagraph(
             pht(
               'If you continue, you will create a new account. You will not '.
               'be able to link this external account to an existing account.'))
           ->addCancelButton('/auth/login/', pht('Cancel'))
           ->addSubmitButton(pht('Create New Account'));
       } else {
         $errors[] = pht(
           'The external account you are registering with has an email address '.
           'that is already in use ("%s") by an existing Phabricator account. '.
           'Choose a new, valid email address to register a new Phabricator '.
           'account.',
           phutil_tag('strong', array(), $show_existing));
       }
     }
 
     $profile = id(new PhabricatorRegistrationProfile())
       ->setDefaultUsername($default_username)
       ->setDefaultEmail($default_email)
       ->setDefaultRealName($default_realname)
       ->setCanEditUsername(true)
       ->setCanEditEmail(($default_email === null))
       ->setCanEditRealName(true)
       ->setShouldVerifyEmail(false);
 
     $event_type = PhabricatorEventType::TYPE_AUTH_WILLREGISTERUSER;
     $event_data = array(
       'account' => $account,
       'profile' => $profile,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
 
     $default_username = $profile->getDefaultUsername();
     $default_email = $profile->getDefaultEmail();
     $default_realname = $profile->getDefaultRealName();
 
     $can_edit_username = $profile->getCanEditUsername();
     $can_edit_email = $profile->getCanEditEmail();
     $can_edit_realname = $profile->getCanEditRealName();
 
-    $must_set_password = $provider->shouldRequireRegistrationPassword();
+    if ($is_setup) {
+      $must_set_password = false;
+    } else {
+      $must_set_password = $provider->shouldRequireRegistrationPassword();
+    }
 
     $can_edit_anything = $profile->getCanEditAnything() || $must_set_password;
     $force_verify = $profile->getShouldVerifyEmail();
 
     // Automatically verify the administrator's email address during first-time
     // setup.
     if ($is_setup) {
       $force_verify = true;
     }
 
     $value_username = $default_username;
     $value_realname = $default_realname;
     $value_email = $default_email;
     $value_password = null;
 
     $require_real_name = PhabricatorEnv::getEnvConfig('user.require-real-name');
 
     $e_username = strlen($value_username) ? null : true;
     $e_realname = $require_real_name ? true : null;
     $e_email = strlen($value_email) ? null : true;
     $e_password = true;
     $e_captcha = true;
 
     $skip_captcha = false;
     if ($invite) {
       // If the user is accepting an invite, assume they're trustworthy enough
       // that we don't need to CAPTCHA them.
       $skip_captcha = true;
     }
 
     $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
     $min_len = (int)$min_len;
 
     $from_invite = $request->getStr('invite');
     if ($from_invite && $can_edit_username) {
       $value_username = $request->getStr('username');
       $e_username = null;
     }
 
     $try_register =
       ($request->isFormPost() || !$can_edit_anything) &&
       !$from_invite &&
       ($request->getInt('phase') != 1);
 
     if ($try_register) {
       $errors = array();
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
       if ($must_set_password && !$skip_captcha) {
         $e_captcha = pht('Again');
 
         $captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
         if (!$captcha_ok) {
           $errors[] = pht('Captcha response is incorrect, try again.');
           $e_captcha = pht('Invalid');
         }
       }
 
       if ($can_edit_username) {
         $value_username = $request->getStr('username');
         if (!strlen($value_username)) {
           $e_username = pht('Required');
           $errors[] = pht('Username is required.');
         } else if (!PhabricatorUser::validateUsername($value_username)) {
           $e_username = pht('Invalid');
           $errors[] = PhabricatorUser::describeValidUsername();
         } else {
           $e_username = null;
         }
       }
 
       if ($must_set_password) {
         $value_password = $request->getStr('password');
         $value_confirm = $request->getStr('confirm');
 
         $password_envelope = new PhutilOpaqueEnvelope($value_password);
         $confirm_envelope = new PhutilOpaqueEnvelope($value_confirm);
 
         $engine = id(new PhabricatorAuthPasswordEngine())
           ->setViewer($user)
           ->setContentSource($content_source)
           ->setPasswordType($account_type)
           ->setObject($user);
 
         try {
           $engine->checkNewPassword($password_envelope, $confirm_envelope);
           $e_password = null;
         } catch (PhabricatorAuthPasswordException $ex) {
           $errors[] = $ex->getMessage();
           $e_password = $ex->getPasswordError();
         }
       }
 
       if ($can_edit_email) {
         $value_email = $request->getStr('email');
         if (!strlen($value_email)) {
           $e_email = pht('Required');
           $errors[] = pht('Email is required.');
         } else if (!PhabricatorUserEmail::isValidAddress($value_email)) {
           $e_email = pht('Invalid');
           $errors[] = PhabricatorUserEmail::describeValidAddresses();
         } else if (!PhabricatorUserEmail::isAllowedAddress($value_email)) {
           $e_email = pht('Disallowed');
           $errors[] = PhabricatorUserEmail::describeAllowedAddresses();
         } else {
           $e_email = null;
         }
       }
 
       if ($can_edit_realname) {
         $value_realname = $request->getStr('realName');
         if (!strlen($value_realname) && $require_real_name) {
           $e_realname = pht('Required');
           $errors[] = pht('Real name is required.');
         } else {
           $e_realname = null;
         }
       }
 
       if (!$errors) {
-        $image = $this->loadProfilePicture($account);
-        if ($image) {
-          $user->setProfileImagePHID($image->getPHID());
+        if (!$is_setup) {
+          $image = $this->loadProfilePicture($account);
+          if ($image) {
+            $user->setProfileImagePHID($image->getPHID());
+          }
         }
 
         try {
           $verify_email = false;
 
           if ($force_verify) {
             $verify_email = true;
           }
 
-          if ($value_email === $default_email) {
-            if ($account->getEmailVerified()) {
-              $verify_email = true;
-            }
+          if (!$is_setup) {
+            if ($value_email === $default_email) {
+              if ($account->getEmailVerified()) {
+                $verify_email = true;
+              }
 
-            if ($provider->shouldTrustEmails()) {
-              $verify_email = true;
-            }
+              if ($provider->shouldTrustEmails()) {
+                $verify_email = true;
+              }
 
-            if ($invite) {
-              $verify_email = true;
+              if ($invite) {
+                $verify_email = true;
+              }
             }
           }
 
           $email_obj = null;
           if ($invite) {
             // If we have a valid invite, this email may exist but be
             // nonprimary and unverified, so we'll reassign it.
             $email_obj = id(new PhabricatorUserEmail())->loadOneWhere(
               'address = %s',
               $value_email);
           }
           if (!$email_obj) {
             $email_obj = id(new PhabricatorUserEmail())
               ->setAddress($value_email);
           }
 
           $email_obj->setIsVerified((int)$verify_email);
 
           $user->setUsername($value_username);
           $user->setRealname($value_realname);
 
           if ($is_setup) {
             $must_approve = false;
           } else if ($invite) {
             $must_approve = false;
           } else {
             $must_approve = PhabricatorEnv::getEnvConfig(
               'auth.require-approval');
           }
 
           if ($must_approve) {
             $user->setIsApproved(0);
           } else {
             $user->setIsApproved(1);
           }
 
           if ($invite) {
             $allow_reassign_email = true;
           } else {
             $allow_reassign_email = false;
           }
 
           $user->openTransaction();
 
             $editor = id(new PhabricatorUserEditor())
               ->setActor($user);
 
             $editor->createNewUser($user, $email_obj, $allow_reassign_email);
             if ($must_set_password) {
               $password_object = PhabricatorAuthPassword::initializeNewPassword(
                 $user,
                 $account_type);
 
               $password_object
                 ->setPassword($password_envelope, $user)
                 ->save();
             }
 
             if ($is_setup) {
               $xactions = array();
               $xactions[] = id(new PhabricatorUserTransaction())
                 ->setTransactionType(
                   PhabricatorUserEmpowerTransaction::TRANSACTIONTYPE)
                 ->setNewValue(true);
 
               $actor = PhabricatorUser::getOmnipotentUser();
               $content_source = PhabricatorContentSource::newFromRequest(
                 $request);
 
               $people_application_phid = id(new PhabricatorPeopleApplication())
                 ->getPHID();
 
               $transaction_editor = id(new PhabricatorUserTransactionEditor())
                 ->setActor($actor)
                 ->setActingAsPHID($people_application_phid)
                 ->setContentSource($content_source)
                 ->setContinueOnMissingFields(true);
 
               $transaction_editor->applyTransactions($user, $xactions);
             }
 
-            $account->setUserPHID($user->getPHID());
-            $provider->willRegisterAccount($account);
-            $account->save();
+            if (!$is_setup) {
+              $account->setUserPHID($user->getPHID());
+              $provider->willRegisterAccount($account);
+              $account->save();
+            }
 
           $user->saveTransaction();
 
           if (!$email_obj->getIsVerified()) {
             $email_obj->sendVerificationEmail($user);
           }
 
           if ($must_approve) {
             $this->sendWaitingForApprovalEmail($user);
           }
 
           if ($invite) {
             $invite->setAcceptedByPHID($user->getPHID())->save();
           }
 
           return $this->loginUser($user);
         } catch (AphrontDuplicateKeyQueryException $exception) {
           $same_username = id(new PhabricatorUser())->loadOneWhere(
             'userName = %s',
             $user->getUserName());
 
           $same_email = id(new PhabricatorUserEmail())->loadOneWhere(
             'address = %s',
             $value_email);
 
           if ($same_username) {
             $e_username = pht('Duplicate');
             $errors[] = pht('Another user already has that username.');
           }
 
           if ($same_email) {
             // TODO: See T3340.
             $e_email = pht('Duplicate');
             $errors[] = pht('Another user already has that email.');
           }
 
           if (!$same_username && !$same_email) {
             throw $exception;
           }
         }
       }
 
       unset($unguarded);
     }
 
     $form = id(new AphrontFormView())
       ->setUser($request->getUser())
       ->addHiddenInput('phase', 2);
 
     if (!$is_default) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('External Account'))
           ->setValue(
             id(new PhabricatorAuthAccountView())
               ->setUser($request->getUser())
               ->setExternalAccount($account)
               ->setAuthProvider($provider)));
     }
 
-
     if ($can_edit_username) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Username'))
           ->setName('username')
           ->setValue($value_username)
           ->setError($e_username));
     } else {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Username'))
           ->setValue($value_username)
           ->setError($e_username));
     }
 
     if ($can_edit_realname) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Real Name'))
           ->setName('realName')
           ->setValue($value_realname)
           ->setError($e_realname));
     }
 
     if ($must_set_password) {
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Password'))
           ->setName('password')
           ->setError($e_password));
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Confirm Password'))
           ->setName('confirm')
           ->setError($e_password)
           ->setCaption(
             $min_len
               ? pht('Minimum length of %d characters.', $min_len)
               : null));
     }
 
     if ($can_edit_email) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Email'))
           ->setName('email')
           ->setValue($value_email)
           ->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
           ->setError($e_email));
     }
 
     if ($must_set_password && !$skip_captcha) {
       $form->appendChild(
         id(new AphrontFormRecaptchaControl())
           ->setLabel(pht('Captcha'))
           ->setError($e_captcha));
     }
 
     $submit = id(new AphrontFormSubmitControl());
 
     if ($is_setup) {
       $submit
         ->setValue(pht('Create Admin Account'));
     } else {
       $submit
         ->addCancelButton($this->getApplicationURI('start/'))
         ->setValue(pht('Register Account'));
     }
 
 
     $form->appendChild($submit);
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($is_setup) {
       $crumbs->addTextCrumb(pht('Setup Admin Account'));
         $title = pht('Welcome to Phabricator');
     } else {
       $crumbs->addTextCrumb(pht('Register'));
       $crumbs->addTextCrumb($provider->getProviderName());
         $title = pht('Create a New Account');
     }
     $crumbs->setBorder(true);
 
     $welcome_view = null;
     if ($is_setup) {
       $welcome_view = id(new PHUIInfoView())
         ->setSeverity(PHUIInfoView::SEVERITY_NOTICE)
         ->setTitle(pht('Welcome to Phabricator'))
         ->appendChild(
           pht(
             'Installation is complete. Register your administrator account '.
             'below to log in. You will be able to configure options and add '.
-            'other authentication mechanisms (like LDAP or OAuth) later on.'));
+            'authentication mechanisms later on.'));
     }
 
     $object_box = id(new PHUIObjectBoxView())
       ->setForm($form)
       ->setFormErrors($errors);
 
     $invite_header = null;
     if ($invite) {
       $invite_header = $this->renderInviteHeader($invite);
     }
 
     $header = id(new PHUIHeaderView())
       ->setHeader($title);
 
     $view = id(new PHUITwoColumnView())
       ->setHeader($header)
-      ->setFooter(array(
-      $welcome_view,
-      $invite_header,
-      $object_box,
-    ));
+      ->setFooter(
+        array(
+          $welcome_view,
+          $invite_header,
+          $object_box,
+        ));
 
     return $this->newPage()
       ->setTitle($title)
       ->setCrumbs($crumbs)
       ->appendChild($view);
   }
 
   private function loadDefaultAccount() {
     $providers = PhabricatorAuthProvider::getAllEnabledProviders();
     $account = null;
     $provider = null;
     $response = null;
 
     foreach ($providers as $key => $candidate_provider) {
       if (!$candidate_provider->shouldAllowRegistration()) {
         unset($providers[$key]);
         continue;
       }
       if (!$candidate_provider->isDefaultRegistrationProvider()) {
         unset($providers[$key]);
       }
     }
 
     if (!$providers) {
       $response = $this->renderError(
         pht(
           'There are no configured default registration providers.'));
       return array($account, $provider, $response);
     } else if (count($providers) > 1) {
       $response = $this->renderError(
         pht('There are too many configured default registration providers.'));
       return array($account, $provider, $response);
     }
 
     $provider = head($providers);
     $account = $provider->getDefaultExternalAccount();
 
     return array($account, $provider, $response);
   }
 
-  private function loadSetupAccount() {
-    $provider = new PhabricatorPasswordAuthProvider();
-    $provider->attachProviderConfig(
-      id(new PhabricatorAuthProviderConfig())
-        ->setShouldAllowRegistration(1)
-        ->setShouldAllowLogin(1)
-        ->setIsEnabled(true));
-
-    $account = $provider->getDefaultExternalAccount();
-    $response = null;
-    return array($account, $provider, $response);
-  }
-
   private function loadProfilePicture(PhabricatorExternalAccount $account) {
     $phid = $account->getProfileImagePHID();
     if (!$phid) {
       return null;
     }
 
     // NOTE: Use of omnipotent user is okay here because the registering user
     // can not control the field value, and we can't use their user object to
     // do meaningful policy checks anyway since they have not registered yet.
     // Reaching this means the user holds the account secret key and the
     // registration secret key, and thus has permission to view the image.
 
     $file = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withPHIDs(array($phid))
       ->executeOne();
     if (!$file) {
       return null;
     }
 
     $xform = PhabricatorFileTransform::getTransformByKey(
       PhabricatorFileThumbnailTransform::TRANSFORM_PROFILE);
     return $xform->executeTransform($file);
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Registration Failed'),
       array($message));
   }
 
   private function sendWaitingForApprovalEmail(PhabricatorUser $user) {
     $title = '[Phabricator] '.pht(
       'New User "%s" Awaiting Approval',
       $user->getUsername());
 
     $body = new PhabricatorMetaMTAMailBody();
 
     $body->addRawSection(
       pht(
         'Newly registered user "%s" is awaiting account approval by an '.
         'administrator.',
         $user->getUsername()));
 
     $body->addLinkSection(
       pht('APPROVAL QUEUE'),
       PhabricatorEnv::getProductionURI(
         '/people/query/approval/'));
 
     $body->addLinkSection(
       pht('DISABLE APPROVAL QUEUE'),
       PhabricatorEnv::getProductionURI(
         '/config/edit/auth.require-approval/'));
 
     $admins = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withIsAdmin(true)
       ->execute();
 
     if (!$admins) {
       return;
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(mpull($admins, 'getPHID'))
       ->setSubject($title)
       ->setBody($body->render())
       ->saveAndSend();
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index 055df8b79e..c675878747 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,1526 +1,1526 @@
 <?php
 
 /**
  * @task availability Availability
  * @task image-cache Profile Image Cache
  * @task factors Multi-Factor Authentication
  * @task handles Managing Handles
  * @task settings Settings
  * @task cache User Cache
  */
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface,
     PhabricatorDestructibleInterface,
     PhabricatorSSHPublicKeyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorApplicationTransactionInterface,
     PhabricatorFulltextInterface,
     PhabricatorFerretInterface,
     PhabricatorConduitResultInterface,
     PhabricatorAuthPasswordHashInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $profileImagePHID;
   protected $defaultProfileImagePHID;
   protected $defaultProfileImageVersion;
   protected $availabilityCache;
   protected $availabilityCacheTTL;
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isMailingList = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
   protected $isEnrolledInMultiFactor = 0;
 
   protected $accountSecret;
 
   private $profile = null;
   private $availability = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
   private $badgePHIDs = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
   private $session = self::ATTACHABLE;
   private $rawCacheData = array();
   private $usableCacheData = array();
 
   private $authorities = array();
   private $handlePool;
   private $csrfSalt;
 
   private $settingCacheKeys = array();
   private $settingCache = array();
   private $allowInlineCacheGeneration;
   private $conduitClusterToken = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isMailingList':
         return (bool)$this->isMailingList;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if (!$this->isLoggedIn()) {
       return false;
     }
 
     if ($this->isOmnipotent()) {
       return true;
     }
 
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
 
   /**
    * Is this a user who we can reasonably expect to respond to requests?
    *
    * This is used to provide a grey "disabled/unresponsive" dot cue when
    * rendering handles and tags, so it isn't a surprise if you get ignored
    * when you ask things of users who will not receive notifications or could
    * not respond to them (because they are disabled, unapproved, do not have
    * verified email addresses, etc).
    *
    * @return bool True if this user can receive and respond to requests from
    *   other humans.
    */
   public function isResponsive() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if (!$this->getIsEmailVerified()) {
       return false;
     }
 
     return true;
   }
 
 
   public function canEstablishWebSessions() {
     if ($this->getIsMailingList()) {
       return false;
     }
 
     if ($this->getIsSystemAgent()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishAPISessions() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     // Intracluster requests are permitted even if the user is logged out:
     // in particular, public users are allowed to issue intracluster requests
     // when browsing Diffusion.
     if (PhabricatorEnv::isClusterRemoteAddress()) {
       if (!$this->isLoggedIn()) {
         return true;
       }
     }
 
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishSSHSessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   /**
    * Returns `true` if this is a standard user who is logged in. Returns `false`
    * for logged out, anonymous, or external users.
    *
    * @return bool `true` if the user is a standard user who is logged in with
    *              a normal session.
    */
   public function getIsStandardUser() {
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_COLUMN_SCHEMA => array(
         'userName' => 'sort64',
         'realName' => 'text128',
         'profileImagePHID' => 'phid?',
         'conduitCertificate' => 'text255',
         'isSystemAgent' => 'bool',
         'isMailingList' => 'bool',
         'isDisabled' => 'bool',
         'isAdmin' => 'bool',
         'isEmailVerified' => 'uint32',
         'isApproved' => 'uint32',
         'accountSecret' => 'bytes64',
         'isEnrolledInMultiFactor' => 'bool',
         'availabilityCache' => 'text255?',
         'availabilityCacheTTL' => 'uint32?',
         'defaultProfileImagePHID' => 'phid?',
         'defaultProfileImageVersion' => 'text64?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'userName' => array(
           'columns' => array('userName'),
           'unique' => true,
         ),
         'realName' => array(
           'columns' => array('realName'),
         ),
         'key_approved' => array(
           'columns' => array('isApproved'),
         ),
       ),
       self::CONFIG_NO_MUTATE => array(
         'availabilityCache' => true,
         'availabilityCacheTTL' => true,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeopleUserPHIDType::TYPECONST);
   }
 
   public function getMonogram() {
     return '@'.$this->getUsername();
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function saveWithoutIndex() {
     return parent::save();
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
 
     if (!strlen($this->getAccountSecret())) {
       $this->setAccountSecret(Filesystem::readRandomCharacters(64));
     }
 
     $result = $this->saveWithoutIndex();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   public function attachSession(PhabricatorAuthSession $session) {
     $this->session = $session;
     return $this;
   }
 
   public function getSession() {
     return $this->assertAttached($this->session);
   }
 
   public function hasSession() {
     return ($this->session !== self::ATTACHABLE);
   }
 
   public function hasHighSecuritySession() {
     if (!$this->hasSession()) {
       return false;
     }
 
     return $this->getSession()->isHighSecuritySession();
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   public function getUserProfile() {
     return $this->assertAttached($this->profile);
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $this->profile = PhabricatorUserProfile::initializeNewProfile($this);
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception(pht('User has no primary email address!'));
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return id(new PhabricatorUserEmail())->loadOneWhere(
       'userPHID = %s AND isPrimary = 1',
       $this->getPHID());
   }
 
 
 /* -(  Settings  )----------------------------------------------------------- */
 
 
   public function getUserSetting($key) {
     // NOTE: We store available keys and cached values separately to make it
     // faster to check for `null` in the cache, which is common.
     if (isset($this->settingCacheKeys[$key])) {
       return $this->settingCache[$key];
     }
 
     $settings_key = PhabricatorUserPreferencesCacheType::KEY_PREFERENCES;
     if ($this->getPHID()) {
       $settings = $this->requireCacheData($settings_key);
     } else {
       $settings = $this->loadGlobalSettings();
     }
 
     if (array_key_exists($key, $settings)) {
       $value = $settings[$key];
       return $this->writeUserSettingCache($key, $value);
     }
 
     $cache = PhabricatorCaches::getRuntimeCache();
     $cache_key = "settings.defaults({$key})";
     $cache_map = $cache->getKeys(array($cache_key));
 
     if ($cache_map) {
       $value = $cache_map[$cache_key];
     } else {
       $defaults = PhabricatorSetting::getAllSettings();
       if (isset($defaults[$key])) {
         $value = id(clone $defaults[$key])
           ->setViewer($this)
           ->getSettingDefaultValue();
       } else {
         $value = null;
       }
 
       $cache->setKey($cache_key, $value);
     }
 
     return $this->writeUserSettingCache($key, $value);
   }
 
 
   /**
    * Test if a given setting is set to a particular value.
    *
    * @param const Setting key.
    * @param wild Value to compare.
    * @return bool True if the setting has the specified value.
    * @task settings
    */
   public function compareUserSetting($key, $value) {
     $actual = $this->getUserSetting($key);
     return ($actual == $value);
   }
 
   private function writeUserSettingCache($key, $value) {
     $this->settingCacheKeys[$key] = true;
     $this->settingCache[$key] = $value;
     return $value;
   }
 
   public function getTranslation() {
     return $this->getUserSetting(PhabricatorTranslationSetting::SETTINGKEY);
   }
 
   public function getTimezoneIdentifier() {
     return $this->getUserSetting(PhabricatorTimezoneSetting::SETTINGKEY);
   }
 
   public static function getGlobalSettingsCacheKey() {
     return 'user.settings.globals.v1';
   }
 
   private function loadGlobalSettings() {
     $cache_key = self::getGlobalSettingsCacheKey();
     $cache = PhabricatorCaches::getMutableStructureCache();
 
     $settings = $cache->getKey($cache_key);
     if (!$settings) {
       $preferences = PhabricatorUserPreferences::loadGlobalPreferences($this);
       $settings = $preferences->getPreferences();
       $cache->setKey($cache_key, $settings);
     }
 
     return $settings;
   }
 
 
   /**
    * Override the user's timezone identifier.
    *
    * This is primarily useful for unit tests.
    *
    * @param string New timezone identifier.
    * @return this
    * @task settings
    */
   public function overrideTimezoneIdentifier($identifier) {
     $timezone_key = PhabricatorTimezoneSetting::SETTINGKEY;
     $this->settingCacheKeys[$timezone_key] = true;
     $this->settingCache[$timezone_key] = $identifier;
     return $this;
   }
 
   public function getGender() {
     return $this->getUserSetting(PhabricatorPronounSetting::SETTINGKEY);
   }
 
   public function loadEditorLink(
     $path,
     $line,
     PhabricatorRepository $repository = null) {
 
     $editor = $this->getUserSetting(PhabricatorEditorSetting::SETTINGKEY);
 
     if (is_array($path)) {
       $multi_key = PhabricatorEditorMultipleSetting::SETTINGKEY;
       $multiedit = $this->getUserSetting($multi_key);
       switch ($multiedit) {
         case PhabricatorEditorMultipleSetting::VALUE_SPACES:
           $path = implode(' ', $path);
           break;
         case PhabricatorEditorMultipleSetting::VALUE_SINGLE:
         default:
           return null;
       }
     }
 
     if (!strlen($editor)) {
       return null;
     }
 
     if ($repository) {
       $callsign = $repository->getCallsign();
     } else {
       $callsign = null;
     }
 
     $uri = strtr($editor, array(
       '%%' => '%',
       '%f' => phutil_escape_uri($path),
       '%l' => phutil_escape_uri($line),
       '%r' => phutil_escape_uri($callsign),
     ));
 
     // The resulting URI must have an allowed protocol. Otherwise, we'll return
     // a link to an error page explaining the misconfiguration.
 
     $ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
     if (!$ok) {
       return '/help/editorprotocol/';
     }
 
     return (string)$uri;
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $tokens = PhabricatorTypeaheadDatasource::tokenizeString(
       $this->getUserName().' '.$this->getRealName());
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %LQ',
         $table,
         $sql);
     }
   }
 
   public static function describeValidUsername() {
     return pht(
-      'Usernames must contain only numbers, letters, period, underscore and '.
+      'Usernames must contain only numbers, letters, period, underscore, and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function getProfileImageURI() {
     $uri_key = PhabricatorUserProfileImageCacheType::KEY_URI;
     return $this->requireCacheData($uri_key);
   }
 
   public function getUnreadNotificationCount() {
     $notification_key = PhabricatorUserNotificationCountCacheType::KEY_COUNT;
     return $this->requireCacheData($notification_key);
   }
 
   public function getUnreadMessageCount() {
     $message_key = PhabricatorUserMessageCountCacheType::KEY_COUNT;
     return $this->requireCacheData($message_key);
   }
 
   public function getRecentBadgeAwards() {
     $badges_key = PhabricatorUserBadgesCacheType::KEY_BADGES;
     return $this->requireCacheData($badges_key);
   }
 
   public function getFullName() {
     if (strlen($this->getRealName())) {
       return $this->getUsername().' ('.$this->getRealName().')';
     } else {
       return $this->getUsername();
     }
   }
 
   public function getTimeZone() {
     return new DateTimeZone($this->getTimezoneIdentifier());
   }
 
   public function getTimeZoneOffset() {
     $timezone = $this->getTimeZone();
     $now = new DateTime('@'.PhabricatorTime::getNow());
     $offset = $timezone->getOffset($now);
 
     // Javascript offsets are in minutes and have the opposite sign.
     $offset = -(int)($offset / 60);
 
     return $offset;
   }
 
   public function getTimeZoneOffsetInHours() {
     $offset = $this->getTimeZoneOffset();
     $offset = (int)round($offset / 60);
     $offset = -$offset;
 
     return $offset;
   }
 
   public function formatShortDateTime($when, $now = null) {
     if ($now === null) {
       $now = PhabricatorTime::getNow();
     }
 
     try {
       $when = new DateTime('@'.$when);
       $now = new DateTime('@'.$now);
     } catch (Exception $ex) {
       return null;
     }
 
     $zone = $this->getTimeZone();
 
     $when->setTimeZone($zone);
     $now->setTimeZone($zone);
 
     if ($when->format('Y') !== $now->format('Y')) {
       // Different year, so show "Feb 31 2075".
       $format = 'M j Y';
     } else if ($when->format('Ymd') !== $now->format('Ymd')) {
       // Same year but different month and day, so show "Feb 31".
       $format = 'M j';
     } else {
       // Same year, month and day so show a time of day.
       $pref_time = PhabricatorTimeFormatSetting::SETTINGKEY;
       $format = $this->getUserSetting($pref_time);
     }
 
     return $when->format($format);
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
   public function getDefaultSpacePHID() {
     // TODO: We might let the user switch which space they're "in" later on;
     // for now just use the global space if one exists.
 
     // If the viewer has access to the default space, use that.
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
     foreach ($spaces as $space) {
       if ($space->getIsDefaultNamespace()) {
         return $space->getPHID();
       }
     }
 
     // Otherwise, use the space with the lowest ID that they have access to.
     // This just tends to keep the default stable and predictable over time,
     // so adding a new space won't change behavior for users.
     if ($spaces) {
       $spaces = msort($spaces, 'getID');
       return head($spaces)->getPHID();
     }
 
     return null;
   }
 
 
   /**
    * Grant a user a source of authority, to let them bypass policy checks they
    * could not otherwise.
    */
   public function grantAuthority($authority) {
     $this->authorities[] = $authority;
     return $this;
   }
 
 
   /**
    * Get authorities granted to the user.
    */
   public function getAuthorities() {
     return $this->authorities;
   }
 
   public function hasConduitClusterToken() {
     return ($this->conduitClusterToken !== self::ATTACHABLE);
   }
 
   public function attachConduitClusterToken(PhabricatorConduitToken $token) {
     $this->conduitClusterToken = $token;
     return $this;
   }
 
   public function getConduitClusterToken() {
     return $this->assertAttached($this->conduitClusterToken);
   }
 
 
 /* -(  Availability  )------------------------------------------------------- */
 
 
   /**
    * @task availability
    */
   public function attachAvailability(array $availability) {
     $this->availability = $availability;
     return $this;
   }
 
 
   /**
    * Get the timestamp the user is away until, if they are currently away.
    *
    * @return int|null Epoch timestamp, or `null` if the user is not away.
    * @task availability
    */
   public function getAwayUntil() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'until');
   }
 
 
   public function getDisplayAvailability() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     $busy = PhabricatorCalendarEventInvitee::AVAILABILITY_BUSY;
 
     return idx($availability, 'availability', $busy);
   }
 
 
   public function getAvailabilityEventPHID() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'eventPHID');
   }
 
 
   /**
    * Get cached availability, if present.
    *
    * @return wild|null Cache data, or null if no cache is available.
    * @task availability
    */
   public function getAvailabilityCache() {
     $now = PhabricatorTime::getNow();
     if ($this->availabilityCacheTTL <= $now) {
       return null;
     }
 
     try {
       return phutil_json_decode($this->availabilityCache);
     } catch (Exception $ex) {
       return null;
     }
   }
 
 
   /**
    * Write to the availability cache.
    *
    * @param wild Availability cache data.
    * @param int|null Cache TTL.
    * @return this
    * @task availability
    */
   public function writeAvailabilityCache(array $availability, $ttl) {
     if (PhabricatorEnv::isReadOnly()) {
       return $this;
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
         WHERE id = %d',
       $this->getTableName(),
       phutil_json_encode($availability),
       $ttl,
       $this->getID());
     unset($unguarded);
 
     return $this;
   }
 
 
 /* -(  Multi-Factor Authentication  )---------------------------------------- */
 
 
   /**
    * Update the flag storing this user's enrollment in multi-factor auth.
    *
    * With certain settings, we need to check if a user has MFA on every page,
    * so we cache MFA enrollment on the user object for performance. Calling this
    * method synchronizes the cache by examining enrollment records. After
    * updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
    * the user is enrolled.
    *
    * This method should be called after any changes are made to a given user's
    * multi-factor configuration.
    *
    * @return void
    * @task factors
    */
   public function updateMultiFactorEnrollment() {
     $factors = id(new PhabricatorAuthFactorConfigQuery())
       ->setViewer($this)
       ->withUserPHIDs(array($this->getPHID()))
       ->withFactorProviderStatuses(
         array(
           PhabricatorAuthFactorProviderStatus::STATUS_ACTIVE,
           PhabricatorAuthFactorProviderStatus::STATUS_DEPRECATED,
         ))
       ->execute();
 
     $enrolled = count($factors) ? 1 : 0;
     if ($enrolled !== $this->isEnrolledInMultiFactor) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         queryfx(
           $this->establishConnection('w'),
           'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
           $this->getTableName(),
           $enrolled,
           $this->getID());
       unset($unguarded);
 
       $this->isEnrolledInMultiFactor = $enrolled;
     }
   }
 
 
   /**
    * Check if the user is enrolled in multi-factor authentication.
    *
    * Enrolled users have one or more multi-factor authentication sources
    * attached to their account. For performance, this value is cached. You
    * can use @{method:updateMultiFactorEnrollment} to update the cache.
    *
    * @return bool True if the user is enrolled.
    * @task factors
    */
   public function getIsEnrolledInMultiFactor() {
     return $this->isEnrolledInMultiFactor;
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
   /**
    * Get a scalar string identifying this user.
    *
    * This is similar to using the PHID, but distinguishes between omnipotent
    * and public users explicitly. This allows safe construction of cache keys
    * or cache buckets which do not conflate public and omnipotent users.
    *
    * @return string Scalar identifier.
    */
   public function getCacheFragment() {
     if ($this->isOmnipotent()) {
       return 'u.omnipotent';
     }
 
     $phid = $this->getPHID();
     if ($phid) {
       return 'u.'.$phid;
     }
 
     return 'u.public';
   }
 
 
 /* -(  Managing Handles  )--------------------------------------------------- */
 
 
   /**
    * Get a @{class:PhabricatorHandleList} which benefits from this viewer's
    * internal handle pool.
    *
    * @param list<phid> List of PHIDs to load.
    * @return PhabricatorHandleList Handle list object.
    * @task handle
    */
   public function loadHandles(array $phids) {
     if ($this->handlePool === null) {
       $this->handlePool = id(new PhabricatorHandlePool())
         ->setViewer($this);
     }
 
     return $this->handlePool->newHandleList($phids);
   }
 
 
   /**
    * Get a @{class:PHUIHandleView} for a single handle.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param phid PHID to render a handle for.
    * @return PHUIHandleView View of the handle.
    * @task handle
    */
   public function renderHandle($phid) {
     return $this->loadHandles(array($phid))->renderHandle($phid);
   }
 
 
   /**
    * Get a @{class:PHUIHandleListView} for a list of handles.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param list<phid> List of PHIDs to render.
    * @return PHUIHandleListView View of the handles.
    * @task handle
    */
   public function renderHandleList(array $phids) {
     return $this->loadHandles($phids)->renderList();
   }
 
   public function attachBadgePHIDs(array $phids) {
     $this->badgePHIDs = $phids;
     return $this;
   }
 
   public function getBadgePHIDs() {
     return $this->assertAttached($this->badgePHIDs);
   }
 
 /* -(  CSRF  )--------------------------------------------------------------- */
 
 
   public function getCSRFToken() {
     if ($this->isOmnipotent()) {
       // We may end up here when called from the daemons. The omnipotent user
       // has no meaningful CSRF token, so just return `null`.
       return null;
     }
 
     return $this->newCSRFEngine()
       ->newToken();
   }
 
   public function validateCSRFToken($token) {
     return $this->newCSRFengine()
       ->isValidToken($token);
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   private function newCSRFEngine() {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getAccountSecret();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     if ($this->hasSession()) {
       $vec = $vec.$this->getSession()->getSessionKey();
     }
 
     $engine = new PhabricatorAuthCSRFEngine();
 
     if ($this->csrfSalt === null) {
       $this->csrfSalt = $engine->newSalt();
     }
 
     $engine
       ->setSalt($this->csrfSalt)
       ->setSecret(new PhutilOpaqueEnvelope($vec));
 
     return $engine;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         if ($this->getIsSystemAgent() || $this->getIsMailingList()) {
           return PhabricatorPolicies::POLICY_ADMIN;
         } else {
           return PhabricatorPolicies::POLICY_NOONE;
         }
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
 
       $externals = id(new PhabricatorExternalAccountQuery())
         ->setViewer($engine->getViewer())
         ->withUserPHIDs(array($this->getPHID()))
         ->execute();
       foreach ($externals as $external) {
         $external->delete();
       }
 
       $prefs = id(new PhabricatorUserPreferencesQuery())
         ->setViewer($engine->getViewer())
         ->withUsers(array($this))
         ->execute();
       foreach ($prefs as $pref) {
         $engine->destroyObject($pref);
       }
 
       $profiles = id(new PhabricatorUserProfile())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($profiles as $profile) {
         $profile->delete();
       }
 
       $keys = id(new PhabricatorAuthSSHKeyQuery())
         ->setViewer($engine->getViewer())
         ->withObjectPHIDs(array($this->getPHID()))
         ->execute();
       foreach ($keys as $key) {
         $engine->destroyObject($key);
       }
 
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($emails as $email) {
         $email->delete();
       }
 
       $sessions = id(new PhabricatorAuthSession())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($factors as $factor) {
         $factor->delete();
       }
 
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorSSHPublicKeyInterface  )----------------------------------- */
 
 
   public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
     if ($viewer->getPHID() == $this->getPHID()) {
       // If the viewer is managing their own keys, take them to the normal
       // panel.
       return '/settings/panel/ssh/';
     } else {
       // Otherwise, take them to the administrative panel for this user.
       return '/settings/user/'.$this->getUsername().'/page/ssh/';
     }
   }
 
   public function getSSHKeyDefaultName() {
     return 'id_rsa_phabricator';
   }
 
   public function getSSHKeyNotifyPHIDs() {
     return array(
       $this->getPHID(),
     );
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorUserTransactionEditor();
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorUserTransaction();
   }
 
 
 /* -(  PhabricatorFulltextInterface  )--------------------------------------- */
 
 
   public function newFulltextEngine() {
     return new PhabricatorUserFulltextEngine();
   }
 
 
 /* -(  PhabricatorFerretInterface  )----------------------------------------- */
 
 
   public function newFerretEngine() {
     return new PhabricatorUserFerretEngine();
   }
 
 
 /* -(  PhabricatorConduitResultInterface  )---------------------------------- */
 
 
   public function getFieldSpecificationsForConduit() {
     return array(
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('username')
         ->setType('string')
         ->setDescription(pht("The user's username.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('realName')
         ->setType('string')
         ->setDescription(pht("The user's real name.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('roles')
         ->setType('list<string>')
         ->setDescription(pht('List of account roles.')),
     );
   }
 
   public function getFieldValuesForConduit() {
     $roles = array();
 
     if ($this->getIsDisabled()) {
       $roles[] = 'disabled';
     }
 
     if ($this->getIsSystemAgent()) {
       $roles[] = 'bot';
     }
 
     if ($this->getIsMailingList()) {
       $roles[] = 'list';
     }
 
     if ($this->getIsAdmin()) {
       $roles[] = 'admin';
     }
 
     if ($this->getIsEmailVerified()) {
       $roles[] = 'verified';
     }
 
     if ($this->getIsApproved()) {
       $roles[] = 'approved';
     }
 
     if ($this->isUserActivated()) {
       $roles[] = 'activated';
     }
 
     return array(
       'username' => $this->getUsername(),
       'realName' => $this->getRealName(),
       'roles' => $roles,
     );
   }
 
   public function getConduitSearchAttachments() {
     return array(
       id(new PhabricatorPeopleAvailabilitySearchEngineAttachment())
         ->setAttachmentKey('availability'),
     );
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   public function attachRawCacheData(array $data) {
     $this->rawCacheData = $data + $this->rawCacheData;
     return $this;
   }
 
   public function setAllowInlineCacheGeneration($allow_cache_generation) {
     $this->allowInlineCacheGeneration = $allow_cache_generation;
     return $this;
   }
 
   /**
    * @task cache
    */
   protected function requireCacheData($key) {
     if (isset($this->usableCacheData[$key])) {
       return $this->usableCacheData[$key];
     }
 
     $type = PhabricatorUserCacheType::requireCacheTypeForKey($key);
 
     if (isset($this->rawCacheData[$key])) {
       $raw_value = $this->rawCacheData[$key];
 
       $usable_value = $type->getValueFromStorage($raw_value);
       $this->usableCacheData[$key] = $usable_value;
 
       return $usable_value;
     }
 
     // By default, we throw if a cache isn't available. This is consistent
     // with the standard `needX()` + `attachX()` + `getX()` interaction.
     if (!$this->allowInlineCacheGeneration) {
       throw new PhabricatorDataNotAttachedException($this);
     }
 
     $user_phid = $this->getPHID();
 
     // Try to read the actual cache before we generate a new value. We can
     // end up here via Conduit, which does not use normal sessions and can
     // not pick up a free cache load during session identification.
     if ($user_phid) {
       $raw_data = PhabricatorUserCache::readCaches(
         $type,
         $key,
         array($user_phid));
       if (array_key_exists($user_phid, $raw_data)) {
         $raw_value = $raw_data[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
         $this->rawCacheData[$key] = $raw_value;
         $this->usableCacheData[$key] = $usable_value;
         return $usable_value;
       }
     }
 
     $usable_value = $type->getDefaultValue();
 
     if ($user_phid) {
       $map = $type->newValueForUsers($key, array($this));
       if (array_key_exists($user_phid, $map)) {
         $raw_value = $map[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
 
         $this->rawCacheData[$key] = $raw_value;
         PhabricatorUserCache::writeCache(
           $type,
           $key,
           $user_phid,
           $raw_value);
       }
     }
 
     $this->usableCacheData[$key] = $usable_value;
 
     return $usable_value;
   }
 
 
   /**
    * @task cache
    */
   public function clearCacheData($key) {
     unset($this->rawCacheData[$key]);
     unset($this->usableCacheData[$key]);
     return $this;
   }
 
 
   public function getCSSValue($variable_key) {
     $preference = PhabricatorAccessibilitySetting::SETTINGKEY;
     $key = $this->getUserSetting($preference);
 
     $postprocessor = CelerityPostprocessor::getPostprocessor($key);
     $variables = $postprocessor->getVariables();
 
     if (!isset($variables[$variable_key])) {
       throw new Exception(
         pht(
           'Unknown CSS variable "%s"!',
           $variable_key));
     }
 
     return $variables[$variable_key];
   }
 
 /* -(  PhabricatorAuthPasswordHashInterface  )------------------------------- */
 
 
   public function newPasswordDigest(
     PhutilOpaqueEnvelope $envelope,
     PhabricatorAuthPassword $password) {
 
     // Before passwords are hashed, they are digested. The goal of digestion
     // is twofold: to reduce the length of very long passwords to something
     // reasonable; and to salt the password in case the best available hasher
     // does not include salt automatically.
 
     // Users may choose arbitrarily long passwords, and attackers may try to
     // attack the system by probing it with very long passwords. When large
     // inputs are passed to hashers -- which are intentionally slow -- it
     // can result in unacceptably long runtimes. The classic attack here is
     // to try to log in with a 64MB password and see if that locks up the
     // machine for the next century. By digesting passwords to a standard
     // length first, the length of the raw input does not impact the runtime
     // of the hashing algorithm.
 
     // Some hashers like bcrypt are self-salting, while other hashers are not.
     // Applying salt while digesting passwords ensures that hashes are salted
     // whether we ultimately select a self-salting hasher or not.
 
     // For legacy compatibility reasons, old VCS and Account password digest
     // algorithms are significantly more complicated than necessary to achieve
     // these goals. This is because they once used a different hashing and
     // salting process. When we upgraded to the modern modular hasher
     // infrastructure, we just bolted it onto the end of the existing pipelines
     // so that upgrading didn't break all users' credentials.
 
     // New implementations can (and, generally, should) safely select the
     // simple HMAC SHA256 digest at the bottom of the function, which does
     // everything that a digest callback should without any needless legacy
     // baggage on top.
 
     if ($password->getLegacyDigestFormat() == 'v1') {
       switch ($password->getPasswordType()) {
         case PhabricatorAuthPassword::PASSWORD_TYPE_VCS:
           // Old VCS passwords use an iterated HMAC SHA1 as a digest algorithm.
           // They originally used this as a hasher, but it became a digest
           // algorithm once hashing was upgraded to include bcrypt.
           $digest = $envelope->openEnvelope();
           $salt = $this->getPHID();
           for ($ii = 0; $ii < 1000; $ii++) {
             $digest = PhabricatorHash::weakDigest($digest, $salt);
           }
           return new PhutilOpaqueEnvelope($digest);
         case PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT:
           // Account passwords previously used this weird mess of salt and did
           // not digest the input to a standard length.
 
           // Beyond this being a weird special case, there are two actual
           // problems with this, although neither are particularly severe:
 
           // First, because we do not normalize the length of passwords, this
           // algorithm may make us vulnerable to DOS attacks where an attacker
           // attempts to use a very long input to slow down hashers.
 
           // Second, because the username is part of the hash algorithm,
           // renaming a user breaks their password. This isn't a huge deal but
           // it's pretty silly. There's no security justification for this
           // behavior, I just didn't think about the implication when I wrote
           // it originally.
 
           $parts = array(
             $this->getUsername(),
             $envelope->openEnvelope(),
             $this->getPHID(),
             $password->getPasswordSalt(),
           );
 
           return new PhutilOpaqueEnvelope(implode('', $parts));
       }
     }
 
     // For passwords which do not have some crazy legacy reason to use some
     // other digest algorithm, HMAC SHA256 is an excellent choice. It satisfies
     // the digest requirements and is simple.
 
     $digest = PhabricatorHash::digestHMACSHA256(
       $envelope->openEnvelope(),
       $password->getPasswordSalt());
 
     return new PhutilOpaqueEnvelope($digest);
   }
 
   public function newPasswordBlocklist(
     PhabricatorUser $viewer,
     PhabricatorAuthPasswordEngine $engine) {
 
     $list = array();
     $list[] = $this->getUsername();
     $list[] = $this->getRealName();
 
     $emails = id(new PhabricatorUserEmail())->loadAllWhere(
       'userPHID = %s',
       $this->getPHID());
     foreach ($emails as $email) {
       $list[] = $email->getAddress();
     }
 
     return $list;
   }
 
 
 }
diff --git a/src/applications/people/storage/PhabricatorUserEmail.php b/src/applications/people/storage/PhabricatorUserEmail.php
index 42946015de..572c7d6e8b 100644
--- a/src/applications/people/storage/PhabricatorUserEmail.php
+++ b/src/applications/people/storage/PhabricatorUserEmail.php
@@ -1,275 +1,274 @@
 <?php
 
 /**
  * @task restrictions   Domain Restrictions
  * @task email          Email About Email
  */
 final class PhabricatorUserEmail extends PhabricatorUserDAO {
 
   protected $userPHID;
   protected $address;
   protected $isVerified;
   protected $isPrimary;
   protected $verificationCode;
 
   const MAX_ADDRESS_LENGTH = 128;
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_COLUMN_SCHEMA => array(
         'address' => 'sort128',
         'isVerified' => 'bool',
         'isPrimary' => 'bool',
         'verificationCode' => 'text64?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'address' => array(
           'columns' => array('address'),
           'unique' => true,
         ),
         'userPHID' => array(
           'columns' => array('userPHID', 'isPrimary'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function getVerificationURI() {
     return '/emailverify/'.$this->getVerificationCode().'/';
   }
 
   public function save() {
     if (!$this->verificationCode) {
       $this->setVerificationCode(Filesystem::readRandomCharacters(24));
     }
     return parent::save();
   }
 
 
 /* -(  Domain Restrictions  )------------------------------------------------ */
 
 
   /**
    * @task restrictions
    */
   public static function isValidAddress($address) {
     if (strlen($address) > self::MAX_ADDRESS_LENGTH) {
       return false;
     }
 
     // Very roughly validate that this address isn't so mangled that a
     // reasonable piece of code might completely misparse it. In particular,
     // the major risks are:
     //
     //   - `PhutilEmailAddress` needs to be able to extract the domain portion
     //     from it.
     //   - Reasonable mail adapters should be hard-pressed to interpret one
     //     address as several addresses.
     //
     // To this end, we're roughly verifying that there's some normal text, an
     // "@" symbol, and then some more normal text.
 
     $email_regex = '(^[a-z0-9_+.!-]+@[a-z0-9_+:.-]+\z)i';
     if (!preg_match($email_regex, $address)) {
       return false;
     }
 
     return true;
   }
 
 
   /**
    * @task restrictions
    */
   public static function describeValidAddresses() {
     return pht(
-      "Email addresses should be in the form '%s'. The maximum ".
-      "length of an email address is %s character(s).",
-      'user@domain.com',
+      'Email addresses should be in the form "user@domain.com". The maximum '.
+      'length of an email address is %s characters.',
       new PhutilNumber(self::MAX_ADDRESS_LENGTH));
   }
 
 
   /**
    * @task restrictions
    */
   public static function isAllowedAddress($address) {
     if (!self::isValidAddress($address)) {
       return false;
     }
 
     $allowed_domains = PhabricatorEnv::getEnvConfig('auth.email-domains');
     if (!$allowed_domains) {
       return true;
     }
 
     $addr_obj = new PhutilEmailAddress($address);
 
     $domain = $addr_obj->getDomainName();
     if (!$domain) {
       return false;
     }
 
     $lower_domain = phutil_utf8_strtolower($domain);
     foreach ($allowed_domains as $allowed_domain) {
       $lower_allowed = phutil_utf8_strtolower($allowed_domain);
       if ($lower_allowed === $lower_domain) {
         return true;
       }
     }
 
     return false;
   }
 
 
   /**
    * @task restrictions
    */
   public static function describeAllowedAddresses() {
     $domains = PhabricatorEnv::getEnvConfig('auth.email-domains');
     if (!$domains) {
       return null;
     }
 
     if (count($domains) == 1) {
       return pht('Email address must be @%s', head($domains));
     } else {
       return pht(
         'Email address must be at one of: %s',
         implode(', ', $domains));
     }
   }
 
 
   /**
    * Check if this install requires email verification.
    *
    * @return bool True if email addresses must be verified.
    *
    * @task restrictions
    */
   public static function isEmailVerificationRequired() {
     // NOTE: Configuring required email domains implies required verification.
     return PhabricatorEnv::getEnvConfig('auth.require-email-verification') ||
            PhabricatorEnv::getEnvConfig('auth.email-domains');
   }
 
 
 /* -(  Email About Email  )-------------------------------------------------- */
 
 
   /**
    * Send a verification email from $user to this address.
    *
    * @param PhabricatorUser The user sending the verification.
    * @return this
    * @task email
    */
   public function sendVerificationEmail(PhabricatorUser $user) {
     $username = $user->getUsername();
 
     $address = $this->getAddress();
     $link = PhabricatorEnv::getProductionURI($this->getVerificationURI());
 
 
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $signature = null;
     if (!$is_serious) {
       $signature = pht("Get Well Soon,\nPhabricator");
     }
 
     $body = sprintf(
       "%s\n\n%s\n\n  %s\n\n%s",
       pht('Hi %s', $username),
       pht(
         'Please verify that you own this email address (%s) by '.
         'clicking this link:',
         $address),
       $link,
       $signature);
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($address))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Email Verification'))
       ->setBody($body)
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
 
     return $this;
   }
 
 
   /**
    * Send a notification email from $user to this address, informing the
    * recipient that this is no longer their account's primary address.
    *
    * @param PhabricatorUser The user sending the notification.
    * @param PhabricatorUserEmail New primary email address.
    * @return this
    * @task email
    */
   public function sendOldPrimaryEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $new) {
     $username = $user->getUsername();
 
     $old_address = $this->getAddress();
     $new_address = $new->getAddress();
 
     $body = sprintf(
       "%s\n\n%s\n",
       pht('Hi %s', $username),
       pht(
         'This email address (%s) is no longer your primary email address. '.
         'Going forward, Phabricator will send all email to your new primary '.
         'email address (%s).',
         $old_address,
         $new_address));
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($old_address))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Primary Address Changed'))
       ->setBody($body)
       ->setFrom($user->getPHID())
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
   }
 
 
   /**
    * Send a notification email from $user to this address, informing the
    * recipient that this is now their account's new primary email address.
    *
    * @param PhabricatorUser The user sending the verification.
    * @return this
    * @task email
    */
   public function sendNewPrimaryEmail(PhabricatorUser $user) {
     $username = $user->getUsername();
 
     $new_address = $this->getAddress();
 
     $body = sprintf(
       "%s\n\n%s\n",
       pht('Hi %s', $username),
       pht(
         'This is now your primary email address (%s). Going forward, '.
         'Phabricator will send all email here.',
         $new_address));
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($new_address))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Primary Address Changed'))
       ->setBody($body)
       ->setFrom($user->getPHID())
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
 
     return $this;
   }
 
 }
diff --git a/src/docs/user/configuration/configuring_accounts_and_registration.diviner b/src/docs/user/configuration/configuring_accounts_and_registration.diviner
index 05d11b11f3..a56d7377cb 100644
--- a/src/docs/user/configuration/configuring_accounts_and_registration.diviner
+++ b/src/docs/user/configuration/configuring_accounts_and_registration.diviner
@@ -1,67 +1,83 @@
 @title Configuring Accounts and Registration
 @group config
 
 Describes how to configure user access to Phabricator.
 
-= Overview =
+Overview
+========
 
 Phabricator supports a number of login systems. You can enable or disable these
 systems to configure who can register for and access your install, and how users
 with existing accounts can login.
 
 Methods of logging in are called **Authentication Providers**. For example,
 there is a "Username/Password" authentication provider available, which allows
 users to log in with a traditional username and password. Other providers
 support logging in with other credentials. For example:
 
   - **LDAP:** Users use LDAP credentials to log in or register.
   - **OAuth:** Users use accounts on a supported OAuth2 provider (like
     GitHub, Facebook, or Google) to log in or register.
   - **Other Providers:** More providers are available, and Phabricator
     can be extended with custom providers. See the "Auth" application for
     a list of available providers.
 
 By default, no providers are enabled. You must use the "Auth" application to
 add one or more providers after you complete the installation process.
 
 After you add a provider, you can link it to existing accounts (for example,
 associate an existing Phabricator account with a GitHub OAuth account) or users
 can use it to register new accounts (assuming you enable these options).
 
-= Recovering Inaccessible Accounts =
+
+Recovering Inaccessible Accounts
+================================
 
 If you accidentally lock yourself out of Phabricator (for example, by disabling
-all authentication providers), you can use the `bin/auth`
-script to recover access to an account. To recover access, run:
+all authentication providers), you can normally use the "send a login link"
+action from the login screen to email yourself a login link and regain access
+to your account.
+
+If that isn't working (perhaps because you haven't configured email yet), you
+can use the `bin/auth` script to recover access to an account. To recover
+access, run:
 
-  phabricator/ $ ./bin/auth recover <username>
+```
+phabricator/ $ ./bin/auth recover <username>
+```
 
 ...where `<username>` is the account username you want to recover access
 to. This will generate a link which will log you in as the specified user.
 
-= Managing Accounts with the Web Console =
+
+Managing Accounts with the Web Console
+======================================
 
 To manage accounts from the web, login as an administrator account and go to
 `/people/` or click "People" on the homepage. Provided you're an admin,
 you'll see options to create or edit accounts.
 
-= Manually Creating New Accounts =
+
+Manually Creating New Accounts
+==============================
 
 There are two ways to manually create new accounts: via the web UI using
 the "People" application (this is easiest), or via the CLI using the
 `accountadmin` binary (this has a few more options).
 
 To use the CLI script, run:
 
   phabricator/ $ ./bin/accountadmin
 
 Some options (like changing certain account flags) are only available from
 the CLI. You can also use this script to make a user
 an administrator (if you accidentally remove your admin flag) or to create an
 administrative account.
 
-= Next Steps =
+
+Next Steps
+==========
 
 Continue by:
 
   - returning to the @{article:Configuration Guide}.