Security and privacy

• Passwords hashed (scrypt); entitlements are server authoritative.
• Users cannot change entitlement from the client.
• A7 must not silently upload private sources to unapproved providers.