Ratelimit login attempts
Refs: #2267
support shibboleth with invitations & enable modifyuser command to remove a user group
Refs: #2167
add support for groups
change authentication methods: progress I
check in /login (redirect) whether user has signed the terms and if not redirect to approval terms
Refs: #2019
merge with master
Fallback on HTTP_X_REAL_IP meta to retrieve client ip
thats where nginx sets the client ip
add captcha field in local user creation form
Ref: #2117
Repo refactor and webproject hooks fixes