Overhaul the 'access' system

[pgengler]

The bot access system should be changed to have 'default' access for non-identified users. This would be used for things like getting and setting infobot phrases. From there, it should be possible to remove these permissions from certain users, so that a user would be able to retrieve infobot phrases but not create or change them.

However, the access system as currently written can't support this, since it relies on a combination of nick and password to identify a user. One option is to make this keyed to a nick/user + hostmask and add an 'identify' or 'login' command to make the bot recognize users whose nick/hostmask has changed. A 'link' command should also be added to permanently add the new nick/hostmask combination.

Administrative actions should still require a password (or perhaps a recent (within 5 minutes?) login). A new administrative permission should be added so that authorized users can add new user accounts for other users and set up the password/hostmask as needed.

[pgengler]

A comment from a related item:
Rather than accepting a password with every authorization-required request, the bot should be changed to accept a set of hostmasks for a user. If a hostmask matches one of these set, the matching user's access is checked for the action, and succeeds or fails as before.

There should also be a way for a user to authenticate with a password for cases when their hostmask doesn't match. If their password is correct they are given a temporary authorization.

[pgengler]

In general, I think there needs to be a much different way of authentication, and whatever that ends up being, it should be carried around internally so that authorization-related functionality doesn't need to parse the string for a password but can simply take the "current user" and check if they're authorized for the action.