Right now I have to manually GPG decrypt a user's password if they lose it.
this needs to be automated someday. Well.. if it ever becomes a problem.
verifiable email addresses need to be mandatory for two reasons:
1: to have a place to send lost passwords
2: to alleviate abuse of the moderation system