Email lockdown

[Pomax]

fixes #16

[Pomax]

Tested this with my mozillafoundation.org account, which works, and my gmail.com and hotmail.com accounts, which get blocked. Admin login not being a moz login is essentially irrelevant as it uses its own login portal on /admin

[alanmoo]

While this technically works, I'm concerned about the silent failure if non-Mozillians attempt to log in. I feel like we need some way to convey "you're not logged in but that's expected". Thoughts?

[Pomax]

fair enough - rather than a redirect to / we can redirect to /login-failure so that we can serve up some content with a 403?

[alanmoo]

Or maybe a query param so that users can still get to the same page when merged with #25?

[Pomax]

oh that's a good idea!

[Pomax]

Updated the PR so that it now does a callback with a loggedin=... that is either True or False depending on whether authentication succeeded or not, and will either redirect the user to / with that argument if no original_url is provided, or redirects to the original_url with that query pair added (with a toggle to make sure we use ?loggedin=... or &loggedin=... depending on whether the original url already had query args)

[alanmoo]

Using .get allows a default? Is this just python behavior?

[Pomax]

yeah, it's a property of Python's dictionaries. You can either do direct access with array notation, or you can use get with a fallback, https://docs.python.org/2/library/stdtypes.html#dict.get