Security review suggested adding an email confirmation stage in the registration process. At present, we don't even require an email (with the next push, we will). This will require multiple changes to the client, ldap architecture, server code, and we have to figure out how to make this work with independent installations. In short, this turns out to be a far from trivial implementation, so I'm punting to ragavan for the roadmap (and not putting it as a blocker).

If we do this, we can kill captcha.

Still on Ragavan to decide if we want this. Pretty sure we don't, at this point.

Agreed that we don't want this. Captcha is fine for account registration.

Okay, WONTFIX it is.