Users should have an account setting to be able to disable sending messages to them via the web form. This should have a default implementation but also be pluggable probably via the auth provider (e.g. SourceForge has this setting already and needs to read from an internal db)
Closed #495.
je/42cc_6888
Added missing CSRF token (and closing tag) to new form, and inverted the preference (from
allow_user_messages
todisable_user_messages
) to clean up the default case (and remove pref-specific logic fromget_pref
).