Reject outgoing mail if MAIL FROM (envelope sender) does not match login name or is not an alias that directs mail (directly) to login name.

ownCloud breaks if download fails (Issue #449)

If the downloaded file doesn't pass hash verification, the script exits and leaves a broken system
Just make hash verification before moving owncloud directory

validate certificates using the cryptography python package as much as possible, shelling out to openssl just once instead of four times per certificate

* Use `cryptography` instead of parsing openssl's output.
* When checking if we can reuse the primary domain certificate or a www-parent-domain certificate for a domain, avoid shelling out to openssl entirely.

[JT added installing netcat-openbsd in system.sh]

add a new autoconfiguration option PRIMARY_HOSTNAME=auto to simply grab the hostname from reverse DNS

drawn from https://github.com/Toilal/mailinabox/commit/5b23a06a7410e4530a56fd6200a6c46c3c6ea9b6.

move more of start.sh into questions.sh to keep start.sh cleaner and encapsulate all of the variable setting in a single script

Based on https://github.com/Toilal/mailinabox/commit/5b23a06a7410e4530a56fd6200a6c46c3c6ea9b6.

fix wrong redirect for automatic www subdomain redirects

$ curl -I https://www.site.co.il/static/images/1.png?a=b | grep Location
Location: https://site.co.il?a=b
but should be something like 
Location: https://site.co.il/static/images/1.png?a=b

This was broken by the ability to have multiple TXT records in 9f1d633a.

fix loop redirecting

server is redirecting the request for this address in a way that will never complete

* Set ssl_stapling_verify to off per https://sslmate.com/blog/post/ocsp_stapling_in_apache_and_nginx ('on' has no security benefits).
* Set resolver to 127.0.0.1, instead of Google Public DNS, because we might as well use our local nameserver anyway.
* Remove the commented line which per the link above would never be necessary anyway.

OCSP seems to work just fine after these changes.

the control panel auth hmac message should also include the user's password so that resetting a password in the database forces that user to log in to the control panel again; also use a sha256 hmac

when the undocumented custom web settings has a redirect or proxy at the root of a domain, use a minimal nginx config template (same as the new default www redirects)

* Split the nginx templates again so we have just the part needed to make a domain do a redirect separate from the rest.
* Add server blocks to the nginx config for these domains.
* List these domains in the SSL certificate install admin panel.
* Generate default 'www' records just for domains we provide default redirects for.

Fixes #321.

This doesn't change anything. Just preparation for the next commit.