Remove redundant event_auth index

Use sys.executable instead of hardcoded python. fixes #1161

Fix email push notifs being dropped

A lot of email push notifications were failing to be sent due to an
exception being thrown along one of the (many) paths. This was due to a
change where we moved from pulling out the full state for each room, but
rather pulled out the event ids for the state and separately loaded the
full events when needed.

User-interactive auth on delete device

We should probably return a 401 rather than a 400 for existing clients that
don't know they have to do the UIA dance to delete a device.

Add config option for adding additional TLS fingerprints

Implement pluggable password auth

Reduce DB hits for replication

Work around email-spamming Riot bug

5d9546f9 introduced a change to synapse behaviour, in that failures in the
interactive-auth process would return the flows and params data as well as an
error code (as specced in https://github.com/matrix-org/matrix-doc/pull/397).

That change exposed a bug in Riot which would make it request a new validation
token (and send a new email) each time it got a 401 with a `flows` parameter
(see https://github.com/vector-im/vector-web/issues/2447 and the fix at
https://github.com/matrix-org/matrix-react-sdk/pull/510).

To preserve compatibility with broken versions of Riot, grandfather in the old
behaviour for the email validation stage.

Remove rate limiting from app service senders and fix get_or_create_user requester

api/auth: fix for not being allowed to set your own state_key

Interactive Auth: Return 401 from for incorrect password

This requires a bit of fettling, because I want to return a helpful error
message too but we don't want to distinguish between unknown user and invalid
password. To avoid hardcoding the error message into 15 places in the code,
I've had to refactor a few methods to return None instead of throwing.

Fixes https://matrix.org/jira/browse/SYN-744

Signed-off-by: Patrik Oldsberg <patrik.oldsberg@ericsson.com>

window.postmessage for Interactive Auth fallback

If you're a webapp running the fallback in an iframe, you can't set set a
window.onAuthDone function. Let's post a message back to window.opener instead.

Signed-off-by: Patrik Oldsberg <patrik.oldsberg@ericsson.com>

Signed-off-by: Patrik Oldsberg <patrik.oldsberg@ericsson.com>

Add Riot brand to email notifs

Allows delegating the password auth to an external module. This also
moves the LDAP auth to using this system, allowing it to be removed from
the synapse tree entirely in the future.