Blogging Roller

I've been working on the Roller user management and login code for over a week now. I just committed a bunch of changes. Here is a summary of my progress in this area:

• HTTPS for login only: Roller can now be configured to force logins to happen over HTTPS, while the rest of the UI remains on HTTP. I did this by using Jon Lipsky's SecureTag from AppFuse to force the login page to HTTPS and then later to force the UI back to HTTP.
  
  
• Editor/Admin UI URL improvements: Editor pages under /editor, admin under /admin. This makes it easier to setup security constraints for editor and admin roles. This was a sweeping change that affected almost all Struts actions in the editor/admin UI.
  
  
• Admin role: admin users are no longer specified in the Roller config, instead they have the admin role. The user-admin page now allows you grant and revoke this role and there is a command-line utility for doing the same.
• Allow admins to create new users: admins can now create new users through the editor/admin UI, even if new user registration is off.
  
  
• Encrypted passwords: Roller can now be configured for encrypted passwords and a utility exists for converting Roller from an unencrypted setup to an encrypted one.
  
  
• Confirmation passwords: all password prompts now ask for password to be entered twice for confirmation.
  
  
• Unit tests with HSQLDB: Added a couple of Ant tasks and so that the Roller build script can start, init, and stop HSQLDB as needed during unit testing. Also added Ant targets so that you can start, init, and stop HSQLDB when you run are running unit tests directly from your IDE.