v0.1.7

Orangescrum Community Edition v0.1.7

Patch release. It fixes a fault that affected every install running an
earlier build.

Uploaded files (issue #33) - every request under /files/ returned 500.
No avatar, project logo or task attachment could be served. Apache does
not accept php_admin_flag in .htaccess, and webroot/files/.htaccess used
it, so Apache failed the whole directory tree rather than skipping the
line. The directives that remain already prevent anything in that tree
from being executed; that was confirmed by planting probes - .php and
.phtml are denied, a .php.jpg is served as inert bytes, ordinary files
are served normally.

This is also what left the profile image on an endless spinner: the
cropper is set up on the preview image, which could never load, so it
never reported a selection. The crop handler is hardened as well, so a
missing selection or a failed request can no longer strand the spinner.

Profile email (issue #34) - a new address is now saved. It used to be
parked in users.update_email behind a confirmation link that this edition
has no code to send and no endpoint to complete, while the screen still
reported success. The address is still refused if another account holds
it, and that refusal now shows its message instead of a 500 page.

ASSET_RELEASE moves to 94. No schema change.