We might as well treat all refresh_tokens as invalid. Just return a 403 from
/tokenrefresh, so that we don't have a load of dead, untestable code hanging
around.

Still TODO: removing the table from the schema.

More intelligent Content-Type parsing

Stop putting a time caveat on access tokens

Content-Type is allowed to contain options (`; charset=utf-8`, for
instance). We should allow that.

Update comments in verify_macaroon

Implement E2E for guests

The 'time' caveat on the access tokens was something of a lie, since we weren't
enforcing it; more pertinently its presence stops us ever adding useful time
caveats.

Let's move in the right direction by not lying in our caveats.

Let pip install multiple packages at once

Pip can install multiple dependencies at the same time, so there is no need to
use xargs -n1. It's significantly slower with -n1, so let's not do it with no
reason.

Since we're not doing refresh tokens any more, we should start killing off the
dead code paths. /tokenrefresh itself is a bit of a thornier subject, since
there might be apps out there using it, but we can at least not generate
refresh tokens on new logins.

Remove redundant list of known caveat prefixes

Expose /devices, /keys, and /sendToDevice to guest users, so that they can use
E2E.

We need to create devices for guests so that they can use e2e, but we don't
have anywhere to store it, so just use a fixed one.

Correctly handle 500's and 429 on federation

Also add some comments.

More efficient notif count queries

Split out federation transaction sending to a worker

Ignore AS users when fetching push rules

By ignoring AS users early on when fetching push rules for a room we can
avoid needlessly hitting the DB and filling up the caches.

Return early on /sync code paths if a '*' filter is used

This is currently very conservative in that it only does this if there is no
`since` token. This limits the risk to clients likely to be doing one-off
syncs (like bridges), but does mean that normal human clients won't benefit
from the time savings here. If the savings are large enough, I would consider
generalising this to just check the filter.

Implement "event_fields" in filters