Preventing bot accounts (captchas) about hknweb

[jvperrin]

I think doing Google OAuth (for HKN emails only) + CalNet auth would be great because it then prevents the need for handling passwords along with preventing bots entirely.

That being said, I haven't worked with CalNet auth much, but ocfweb already uses it and I've worked with Google OAuth before and it's not terrible (although it is complicated), so I think that might be doable.

The captcha we are using on hkn.eecs.berkeley.edu currently doesn't seem very effective (we still get lots of bots signing up), maybe we aren't validating it correctly?

[jameslzhu]

Some recap from what we talked about today:

1. Minimize bot accounts
   a. This would be largely a signup page protection: some captcha code snippet to prevent account creation.
2. Make sure they can't access anything: require human (compserv / vp) approval for any site access.
   a. Make finding bad accounts easy (bots)
   b. Make finding good accounts easy (professors, candidates, TAs)
   c. Make cleanup / deleting accounts easy (but not too easy: want some confirmation)
   d. This would go under a separate /accounts/manage page.

Since the signup page is still pending in #51, you can put off the actual implementation of 1) for now; part 2 should probably be implemented as part of the root hknweb accounts urls / views / models.

[jameslzhu]

After the merge, we should drop the recaptcha key into the secrets file from the Recaptcha admin console, with the hkn-ops account. I've made a separate key for the hknweb site.
https://www.google.com/recaptcha/admin

[bri25yu]

Closed as per the previously linked PR