diff --git a/scripts/user/account_admin.php b/scripts/user/account_admin.php
index d966240f1..08e50ac50 100755
--- a/scripts/user/account_admin.php
+++ b/scripts/user/account_admin.php
@@ -1,199 +1,200 @@
 #!/usr/bin/env php
 <?php
 
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
 echo "Enter a username to create a new account or edit an existing account.";
 
 $username = phutil_console_prompt("Enter a username:");
 if (!strlen($username)) {
   echo "Cancelled.\n";
   exit(1);
 }
 
 if (!PhabricatorUser::validateUsername($username)) {
   $valid = PhabricatorUser::describeValidUsername();
   echo "The username '{$username}' is invalid. {$valid}\n";
   exit(1);
 }
 
 
 $user = id(new PhabricatorUser())->loadOneWhere(
   'username = %s',
   $username);
 
 if (!$user) {
   $original = new PhabricatorUser();
 
   echo "There is no existing user account '{$username}'.\n";
   $ok = phutil_console_confirm(
     "Do you want to create a new '{$username}' account?",
     $default_no = false);
   if (!$ok) {
     echo "Cancelled.\n";
     exit(1);
   }
   $user = new PhabricatorUser();
   $user->setUsername($username);
 
   $is_new = true;
 } else {
   $original = clone $user;
 
   echo "There is an existing user account '{$username}'.\n";
   $ok = phutil_console_confirm(
     "Do you want to edit the existing '{$username}' account?",
     $default_no = false);
   if (!$ok) {
     echo "Cancelled.\n";
     exit(1);
   }
 
   $is_new = false;
 }
 
 $user_realname = $user->getRealName();
 if (strlen($user_realname)) {
   $realname_prompt = ' ['.$user_realname.']';
 } else {
   $realname_prompt = '';
 }
 $realname = nonempty(
   phutil_console_prompt("Enter user real name{$realname_prompt}:"),
   $user_realname);
 $user->setRealName($realname);
 
 // When creating a new user we prompt for an email address; when editing an
 // existing user we just skip this because it would be quite involved to provide
 // a reasonable CLI interface for editing multiple addresses and managing email
 // verification and primary addresses.
 
 $create_email = null;
 if ($is_new) {
   do {
     $email = phutil_console_prompt("Enter user email address:");
     $duplicate = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $email);
     if ($duplicate) {
       echo "ERROR: There is already a user with that email address. ".
            "Each user must have a unique email address.\n";
     } else {
       break;
     }
   } while (true);
 
   $create_email = $email;
 }
 
 $changed_pass = false;
 // This disables local echo, so the user's password is not shown as they type
 // it.
 phutil_passthru('stty -echo');
 $password = phutil_console_prompt(
   "Enter a password for this user [blank to leave unchanged]:");
 phutil_passthru('stty echo');
 if (strlen($password)) {
   $changed_pass = $password;
 }
 
 $is_system_agent = $user->getIsSystemAgent();
 $set_system_agent = phutil_console_confirm(
   'Should this user be a system agent?',
   $default_no = !$is_system_agent);
 
 $verify_email = null;
 $set_verified = false;
 // Allow administrators to verify primary email addresses at this time in edit
 // scenarios. (Create will work just fine from here as we auto-verify email
 // on create.)
 if (!$is_new) {
   $verify_email = $user->loadPrimaryEmail();
   if (!$verify_email->getIsVerified()) {
     $set_verified = phutil_console_confirm(
       'Should the primary email address be verified?',
       $default_no = true);
   } else {
     // already verified so let's not make a fuss
     $verify_email = null;
   }
 }
 
 $is_admin = $user->getIsAdmin();
 $set_admin = phutil_console_confirm(
   'Should this user be an administrator?',
   $default_no = !$is_admin);
 
 echo "\n\nACCOUNT SUMMARY\n\n";
 $tpl = "%12s   %-30s   %-30s\n";
 printf($tpl, null, 'OLD VALUE', 'NEW VALUE');
 printf($tpl, 'Username', $original->getUsername(), $user->getUsername());
 printf($tpl, 'Real Name', $original->getRealName(), $user->getRealName());
 if ($is_new) {
   printf($tpl, 'Email', '', $create_email);
 }
 printf($tpl, 'Password', null,
   ($changed_pass !== false)
     ? 'Updated'
     : 'Unchanged');
 
 printf(
   $tpl,
   'System Agent',
   $original->getIsSystemAgent() ? 'Y' : 'N',
   $set_system_agent ? 'Y' : 'N');
 
 if ($verify_email) {
   printf(
     $tpl,
     'Verify Email',
     $verify_email->getIsVerified() ? 'Y' : 'N',
     $set_verified ? 'Y' : 'N');
 }
 
 printf(
   $tpl,
   'Admin',
   $original->getIsAdmin() ? 'Y' : 'N',
   $set_admin ? 'Y' : 'N');
 
 echo "\n";
 
 if (!phutil_console_confirm("Save these changes?", $default_no = false)) {
   echo "Cancelled.\n";
   exit(1);
 }
 
 $user->openTransaction();
 
   $editor = new PhabricatorUserEditor();
 
   // TODO: This is wrong, but we have a chicken-and-egg problem when you use
   // this script to create the first user.
   $editor->setActor($user);
 
   if ($is_new) {
     $email = id(new PhabricatorUserEmail())
       ->setAddress($create_email)
       ->setIsVerified(1);
 
     $editor->createNewUser($user, $email);
   } else {
     if ($verify_email) {
+      $user->setIsEmailVerified(1);
       $verify_email->setIsVerified($set_verified ? 1 : 0);
     }
     $editor->updateUser($user, $verify_email);
   }
 
   $editor->makeAdminUser($user, $set_admin);
   $editor->makeSystemAgentUser($user, $set_system_agent);
 
   if ($changed_pass !== false) {
     $envelope = new PhutilOpaqueEnvelope($changed_pass);
     $editor->changePassword($user, $envelope);
   }
 
 $user->saveTransaction();
 
 echo "Saved changes.\n";
diff --git a/scripts/user/add_user.php b/scripts/user/add_user.php
index edb6a1a26..958ff4b89 100755
--- a/scripts/user/add_user.php
+++ b/scripts/user/add_user.php
@@ -1,56 +1,57 @@
 #!/usr/bin/env php
 <?php
 
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
 if ($argc !== 5) {
   echo "usage: add_user.php <username> <email> <realname> <admin_user>\n";
   exit(1);
 }
 
 $username = $argv[1];
 $email = $argv[2];
 $realname = $argv[3];
 $admin = $argv[4];
 
 $admin = id(new PhabricatorUser())->loadOneWhere(
   'username = %s',
   $argv[4]);
 if (!$admin) {
   throw new Exception(
     "Admin user must be the username of a valid Phabricator account, used ".
     "to send the new user a welcome email.");
 }
 
 $existing_user = id(new PhabricatorUser())->loadOneWhere(
   'username = %s',
   $username);
 if ($existing_user) {
   throw new Exception(
     "There is already a user with the username '{$username}'!");
 }
 
 $existing_email = id(new PhabricatorUserEmail())->loadOneWhere(
   'address = %s',
   $email);
 if ($existing_email) {
   throw new Exception(
     "There is already a user with the email '{$email}'!");
 }
 
 $user = new PhabricatorUser();
 $user->setUsername($username);
 $user->setRealname($realname);
+$user->setIsApproved(1);
 
 $email_object = id(new PhabricatorUserEmail())
   ->setAddress($email)
   ->setIsVerified(1);
 
 id(new PhabricatorUserEditor())
   ->setActor($admin)
   ->createNewUser($user, $email_object);
 
 $user->sendWelcomeEmail($admin);
 
 echo "Created user '{$username}' (realname='{$realname}', email='{$email}').\n";
diff --git a/src/applications/auth/controller/PhabricatorAuthRegisterController.php b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
index a5530c460..b1dcd8b19 100644
--- a/src/applications/auth/controller/PhabricatorAuthRegisterController.php
+++ b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
@@ -1,509 +1,565 @@
 <?php
 
 final class PhabricatorAuthRegisterController
   extends PhabricatorAuthController {
 
   private $accountKey;
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function willProcessRequest(array $data) {
     $this->accountKey = idx($data, 'akey');
   }
 
   public function processRequest() {
     $request = $this->getRequest();
 
     if ($request->getUser()->isLoggedIn()) {
       return $this->renderError(pht('You are already logged in.'));
     }
 
     $is_setup = false;
     if (strlen($this->accountKey)) {
       $result = $this->loadAccountForRegistrationOrLinking($this->accountKey);
       list($account, $provider, $response) = $result;
       $is_default = false;
     } else if ($this->isFirstTimeSetup()) {
       list($account, $provider, $response) = $this->loadSetupAccount();
       $is_default = true;
       $is_setup = true;
     } else {
       list($account, $provider, $response) = $this->loadDefaultAccount();
       $is_default = true;
     }
 
     if ($response) {
       return $response;
     }
 
     if (!$provider->shouldAllowRegistration()) {
 
       // TODO: This is a routine error if you click "Login" on an external
       // auth source which doesn't allow registration. The error should be
       // more tailored.
 
       return $this->renderError(
         pht(
           'The account you are attempting to register with uses an '.
           'authentication provider ("%s") which does not allow registration. '.
           'An administrator may have recently disabled registration with this '.
           'provider.',
           $provider->getProviderName()));
     }
 
     $user = new PhabricatorUser();
 
     $default_username = $account->getUsername();
     $default_realname = $account->getRealName();
     $default_email = $account->getEmail();
     if ($default_email) {
       // If the account source provided an email, but it's not allowed by
       // the configuration, roadblock the user. Previously, we let the user
       // pick a valid email address instead, but this does not align well with
       // user expectation and it's not clear the cases it enables are valuable.
       // See discussion in T3472.
       if (!PhabricatorUserEmail::isAllowedAddress($default_email)) {
         return $this->renderError(
           array(
             pht(
               'The account you are attempting to register with has an invalid '.
               'email address (%s). This Phabricator install only allows '.
               'registration with specific email addresses:',
               $default_email),
             phutil_tag('br'),
             phutil_tag('br'),
             PhabricatorUserEmail::describeAllowedAddresses(),
           ));
       }
 
       // If the account source provided an email, but another account already
       // has that email, just pretend we didn't get an email.
 
       // TODO: See T3340.
       // TODO: See T3472.
 
       if ($default_email) {
         $same_email = id(new PhabricatorUserEmail())->loadOneWhere(
           'address = %s',
           $default_email);
         if ($same_email) {
           $default_email = null;
         }
       }
     }
 
     $profile = id(new PhabricatorRegistrationProfile())
       ->setDefaultUsername($default_username)
       ->setDefaultEmail($default_email)
       ->setDefaultRealName($default_realname)
       ->setCanEditUsername(true)
       ->setCanEditEmail(($default_email === null))
       ->setCanEditRealName(true)
       ->setShouldVerifyEmail(false);
 
     $event_type = PhabricatorEventType::TYPE_AUTH_WILLREGISTERUSER;
     $event_data = array(
       'account' => $account,
       'profile' => $profile,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
 
     $default_username = $profile->getDefaultUsername();
     $default_email = $profile->getDefaultEmail();
     $default_realname = $profile->getDefaultRealName();
 
     $can_edit_username = $profile->getCanEditUsername();
     $can_edit_email = $profile->getCanEditEmail();
     $can_edit_realname = $profile->getCanEditRealName();
 
     $must_set_password = $provider->shouldRequireRegistrationPassword();
 
     $can_edit_anything = $profile->getCanEditAnything() || $must_set_password;
     $force_verify = $profile->getShouldVerifyEmail();
 
     $value_username = $default_username;
     $value_realname = $default_realname;
     $value_email = $default_email;
     $value_password = null;
 
     $errors = array();
 
     $e_username = strlen($value_username) ? null : true;
     $e_realname = strlen($value_realname) ? null : true;
     $e_email = strlen($value_email) ? null : true;
     $e_password = true;
     $e_captcha = true;
 
     $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
     $min_len = (int)$min_len;
 
     if ($request->isFormPost() || !$can_edit_anything) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
       if ($must_set_password) {
         $e_captcha = pht('Again');
 
         $captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
         if (!$captcha_ok) {
           $errors[] = pht("Captcha response is incorrect, try again.");
           $e_captcha = pht('Invalid');
         }
       }
 
       if ($can_edit_username) {
         $value_username = $request->getStr('username');
         if (!strlen($value_username)) {
           $e_username = pht('Required');
           $errors[] = pht('Username is required.');
         } else if (!PhabricatorUser::validateUsername($value_username)) {
           $e_username = pht('Invalid');
           $errors[] = PhabricatorUser::describeValidUsername();
         } else {
           $e_username = null;
         }
       }
 
       if ($must_set_password) {
         $value_password = $request->getStr('password');
         $value_confirm = $request->getStr('confirm');
         if (!strlen($value_password)) {
           $e_password = pht('Required');
           $errors[] = pht('You must choose a password.');
         } else if ($value_password !== $value_confirm) {
           $e_password = pht('No Match');
           $errors[] = pht('Password and confirmation must match.');
         } else if (strlen($value_password) < $min_len) {
           $e_password = pht('Too Short');
           $errors[] = pht(
             'Password is too short (must be at least %d characters long).',
             $min_len);
         } else {
           $e_password = null;
         }
       }
 
       if ($can_edit_email) {
         $value_email = $request->getStr('email');
         if (!strlen($value_email)) {
           $e_email = pht('Required');
           $errors[] = pht('Email is required.');
         } else if (!PhabricatorUserEmail::isAllowedAddress($value_email)) {
           $e_email = pht('Invalid');
           $errors[] = PhabricatorUserEmail::describeAllowedAddresses();
         } else {
           $e_email = null;
         }
       }
 
       if ($can_edit_realname) {
         $value_realname = $request->getStr('realName');
         if (!strlen($value_realname)) {
           $e_realname = pht('Required');
           $errors[] = pht('Real name is required.');
         } else {
           $e_realname = null;
         }
       }
 
       if (!$errors) {
         $image = $this->loadProfilePicture($account);
         if ($image) {
           $user->setProfileImagePHID($image->getPHID());
         }
 
         try {
           if ($force_verify) {
             $verify_email = true;
           } else {
             $verify_email =
               ($account->getEmailVerified()) &&
               ($value_email === $default_email);
           }
 
           $email_obj = id(new PhabricatorUserEmail())
             ->setAddress($value_email)
             ->setIsVerified((int)$verify_email);
 
           $user->setUsername($value_username);
           $user->setRealname($value_realname);
 
+          if ($is_setup) {
+            $must_approve = false;
+          } else {
+            $must_approve = PhabricatorEnv::getEnvConfig(
+              'auth.require-approval');
+          }
+
+          if ($must_approve) {
+            $user->setIsApproved(0);
+          } else {
+            $user->setIsApproved(1);
+          }
+
           $user->openTransaction();
 
             $editor = id(new PhabricatorUserEditor())
               ->setActor($user);
 
             $editor->createNewUser($user, $email_obj);
             if ($must_set_password) {
               $envelope = new PhutilOpaqueEnvelope($value_password);
               $editor->changePassword($user, $envelope);
             }
 
             if ($is_setup) {
               $editor->makeAdminUser($user, true);
             }
 
             $account->setUserPHID($user->getPHID());
             $provider->willRegisterAccount($account);
             $account->save();
 
           $user->saveTransaction();
 
           if (!$email_obj->getIsVerified()) {
             $email_obj->sendVerificationEmail($user);
           }
 
+          if ($must_approve) {
+            $this->sendWaitingForApprovalEmail($user);
+          }
+
           return $this->loginUser($user);
         } catch (AphrontQueryDuplicateKeyException $exception) {
           $same_username = id(new PhabricatorUser())->loadOneWhere(
             'userName = %s',
             $user->getUserName());
 
           $same_email = id(new PhabricatorUserEmail())->loadOneWhere(
             'address = %s',
             $value_email);
 
           if ($same_username) {
             $e_username = pht('Duplicate');
             $errors[] = pht('Another user already has that username.');
           }
 
           if ($same_email) {
             // TODO: See T3340.
             $e_email = pht('Duplicate');
             $errors[] = pht('Another user already has that email.');
           }
 
           if (!$same_username && !$same_email) {
             throw $exception;
           }
         }
       }
 
       unset($unguarded);
     }
 
     $error_view = null;
     if ($errors) {
       $error_view = new AphrontErrorView();
       $error_view->setTitle(pht('Registration Failed'));
       $error_view->setErrors($errors);
     }
 
     $form = id(new AphrontFormView())
       ->setUser($request->getUser());
 
     if (!$is_default) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('External Account'))
           ->setValue(
             id(new PhabricatorAuthAccountView())
               ->setUser($request->getUser())
               ->setExternalAccount($account)
               ->setAuthProvider($provider)));
     }
 
 
     $form
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Phabricator Username'))
           ->setName('username')
           ->setValue($value_username)
           ->setError($e_username));
 
     if ($must_set_password) {
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Password'))
           ->setName('password')
           ->setError($e_password)
           ->setCaption(
             $min_len
               ? pht('Minimum length of %d characters.', $min_len)
               : null));
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Confirm Password'))
           ->setName('confirm')
           ->setError($e_password));
     }
 
     if ($can_edit_email) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Email'))
           ->setName('email')
           ->setValue($value_email)
           ->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
           ->setError($e_email));
     }
 
     if ($can_edit_realname) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Real Name'))
           ->setName('realName')
           ->setValue($value_realname)
           ->setError($e_realname));
     }
 
     if ($must_set_password) {
       $form->appendChild(
         id(new AphrontFormRecaptchaControl())
           ->setLabel(pht('Captcha'))
           ->setError($e_captcha));
     }
 
     $submit = id(new AphrontFormSubmitControl());
 
     if ($is_setup) {
       $submit
         ->setValue(pht('Create Admin Account'));
     } else {
       $submit
         ->addCancelButton($this->getApplicationURI('start/'))
         ->setValue(pht('Register Phabricator Account'));
     }
 
 
     $form->appendChild($submit);
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($is_setup) {
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName(pht('Setup Admin Account')));
         $title = pht('Welcome to Phabricator');
     } else {
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName(pht('Register')));
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName($provider->getProviderName()));
         $title = pht('Phabricator Registration');
     }
 
     $welcome_view = null;
     if ($is_setup) {
       $welcome_view = id(new AphrontErrorView())
         ->setSeverity(AphrontErrorView::SEVERITY_NOTICE)
         ->setTitle(pht('Welcome to Phabricator'))
         ->appendChild(
           pht(
             'Installation is complete. Register your administrator account '.
             'below to log in. You will be able to configure options and add '.
             'other authentication mechanisms (like LDAP or OAuth) later on.'));
     }
 
     $object_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setForm($form)
       ->setFormError($error_view);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $welcome_view,
         $object_box,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
   private function loadDefaultAccount() {
     $providers = PhabricatorAuthProvider::getAllEnabledProviders();
     $account = null;
     $provider = null;
     $response = null;
 
     foreach ($providers as $key => $candidate_provider) {
       if (!$candidate_provider->shouldAllowRegistration()) {
         unset($providers[$key]);
         continue;
       }
       if (!$candidate_provider->isDefaultRegistrationProvider()) {
         unset($providers[$key]);
       }
     }
 
     if (!$providers) {
       $response = $this->renderError(
         pht(
           "There are no configured default registration providers."));
       return array($account, $provider, $response);
     } else if (count($providers) > 1) {
       $response = $this->renderError(
         pht(
           "There are too many configured default registration providers."));
       return array($account, $provider, $response);
     }
 
     $provider = head($providers);
     $account = $provider->getDefaultExternalAccount();
 
     return array($account, $provider, $response);
   }
 
   private function loadSetupAccount() {
     $provider = new PhabricatorAuthProviderPassword();
     $provider->attachProviderConfig(
       id(new PhabricatorAuthProviderConfig())
         ->setShouldAllowRegistration(1)
         ->setShouldAllowLogin(1)
         ->setIsEnabled(true));
 
     $account = $provider->getDefaultExternalAccount();
     $response = null;
     return array($account, $provider, $response);
   }
 
   private function loadProfilePicture(PhabricatorExternalAccount $account) {
     $phid = $account->getProfileImagePHID();
     if (!$phid) {
       return null;
     }
 
     // NOTE: Use of omnipotent user is okay here because the registering user
     // can not control the field value, and we can't use their user object to
     // do meaningful policy checks anyway since they have not registered yet.
     // Reaching this means the user holds the account secret key and the
     // registration secret key, and thus has permission to view the image.
 
     $file = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withPHIDs(array($phid))
       ->executeOne();
     if (!$file) {
       return null;
     }
 
     try {
       $xformer = new PhabricatorImageTransformer();
       return $xformer->executeProfileTransform(
         $file,
         $width = 50,
         $min_height = 50,
         $max_height = 50);
     } catch (Exception $ex) {
       phlog($ex);
       return null;
     }
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Registration Failed'),
       array($message));
   }
 
+  private function sendWaitingForApprovalEmail(PhabricatorUser $user) {
+    $title = '[Phabricator] '.pht(
+      'New User "%s" Awaiting Approval',
+      $user->getUsername());
+
+    $body = new PhabricatorMetaMTAMailBody();
+
+    $body->addRawSection(
+      pht(
+        'Newly registered user "%s" is awaiting account approval by an '.
+        'administrator.',
+        $user->getUsername()));
+
+    $body->addTextSection(
+      pht('APPROVAL QUEUE'),
+      PhabricatorEnv::getProductionURI(
+        '/people/query/approval/'));
+
+    $body->addTextSection(
+      pht('DISABLE APPROVAL QUEUE'),
+      PhabricatorEnv::getProductionURI(
+        '/config/edit/auth.require-approval/'));
+
+    $admins = id(new PhabricatorPeopleQuery())
+      ->setViewer(PhabricatorUser::getOmnipotentUser())
+      ->withIsAdmin(true)
+      ->execute();
+
+    if (!$admins) {
+      return;
+    }
+
+    $mail = id(new PhabricatorMetaMTAMail())
+      ->addTos(mpull($admins, 'getPHID'))
+      ->setSubject($title)
+      ->setBody($body->render())
+      ->saveAndSend();
+  }
+
 }
diff --git a/src/applications/config/controller/PhabricatorConfigEditController.php b/src/applications/config/controller/PhabricatorConfigEditController.php
index 7ec6e41c7..f7bf9cbb1 100644
--- a/src/applications/config/controller/PhabricatorConfigEditController.php
+++ b/src/applications/config/controller/PhabricatorConfigEditController.php
@@ -1,545 +1,545 @@
 <?php
 
 final class PhabricatorConfigEditController
   extends PhabricatorConfigController {
 
   private $key;
 
   public function willProcessRequest(array $data) {
     $this->key = $data['key'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
 
     $options = PhabricatorApplicationConfigOptions::loadAllOptions();
     if (empty($options[$this->key])) {
       $ancient = PhabricatorSetupCheckExtraConfig::getAncientConfig();
       if (isset($ancient[$this->key])) {
         $desc = pht(
           "This configuration has been removed. You can safely delete ".
           "it.\n\n%s",
           $ancient[$this->key]);
       } else {
         $desc = pht(
           "This configuration option is unknown. It may be misspelled, ".
           "or have existed in a previous version of Phabricator.");
       }
 
       // This may be a dead config entry, which existed in the past but no
       // longer exists. Allow it to be edited so it can be reviewed and
       // deleted.
       $option = id(new PhabricatorConfigOption())
         ->setKey($this->key)
         ->setType('wild')
         ->setDefault(null)
         ->setDescription($desc);
       $group = null;
       $group_uri = $this->getApplicationURI();
     } else {
       $option = $options[$this->key];
       $group = $option->getGroup();
       $group_uri = $this->getApplicationURI('group/'.$group->getKey().'/');
     }
 
     $issue = $request->getStr('issue');
     if ($issue) {
       // If the user came here from an open setup issue, send them back.
       $done_uri = $this->getApplicationURI('issue/'.$issue.'/');
     } else {
       $done_uri = $group_uri;
     }
 
     // Check if the config key is already stored in the database.
     // Grab the value if it is.
     $config_entry = id(new PhabricatorConfigEntry())
       ->loadOneWhere(
         'configKey = %s AND namespace = %s',
         $this->key,
         'default');
     if (!$config_entry) {
       $config_entry = id(new PhabricatorConfigEntry())
         ->setConfigKey($this->key)
         ->setNamespace('default')
         ->setIsDeleted(true);
       $config_entry->setPHID($config_entry->generatePHID());
     }
 
     $e_value = null;
     $errors = array();
     if ($request->isFormPost() && !$option->getLocked()) {
 
       $result = $this->readRequest(
         $option,
         $request);
 
       list($e_value, $value_errors, $display_value, $xaction) = $result;
       $errors = array_merge($errors, $value_errors);
 
       if (!$errors) {
 
         $editor = id(new PhabricatorConfigEditor())
           ->setActor($user)
           ->setContinueOnNoEffect(true)
           ->setContentSourceFromRequest($request);
 
         try {
           $editor->applyTransactions($config_entry, array($xaction));
           return id(new AphrontRedirectResponse())->setURI($done_uri);
         } catch (PhabricatorConfigValidationException $ex) {
           $e_value = pht('Invalid');
           $errors[] = $ex->getMessage();
         }
       }
     } else {
       $display_value = $this->getDisplayValue($option, $config_entry);
     }
 
     $form = new AphrontFormView();
 
     $error_view = null;
     if ($errors) {
       $error_view = id(new AphrontErrorView())
         ->setTitle(pht('You broke everything!'))
         ->setErrors($errors);
     } else if ($option->getHidden()) {
       $msg = pht(
         "This configuration is hidden and can not be edited or viewed from ".
         "the web interface.");
 
       $error_view = id(new AphrontErrorView())
         ->setTitle(pht('Configuration Hidden'))
         ->setSeverity(AphrontErrorView::SEVERITY_WARNING)
         ->appendChild(phutil_tag('p', array(), $msg));
     } else if ($option->getLocked()) {
       $msg = pht(
         "This configuration is locked and can not be edited from the web ".
         "interface. Use `./bin/config` in `phabricator/` to edit it.");
 
       $error_view = id(new AphrontErrorView())
         ->setTitle(pht('Configuration Locked'))
         ->setSeverity(AphrontErrorView::SEVERITY_NOTICE)
         ->appendChild(phutil_tag('p', array(), $msg));
     }
 
     if ($option->getHidden()) {
       $control = null;
     } else {
       $control = $this->renderControl(
         $option,
         $display_value,
         $e_value);
     }
 
     $engine = new PhabricatorMarkupEngine();
     $engine->setViewer($user);
     $engine->addObject($option, 'description');
     $engine->process();
     $description = phutil_tag(
       'div',
       array(
         'class' => 'phabricator-remarkup',
       ),
       $engine->getOutput($option, 'description'));
 
     $form
       ->setUser($user)
       ->addHiddenInput('issue', $request->getStr('issue'))
       ->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Description'))
           ->setValue($description));
 
     if ($group) {
       $extra = $group->renderContextualDescription(
         $option,
         $request);
       if ($extra !== null) {
         $form->appendChild(
           id(new AphrontFormMarkupControl())
             ->setValue($extra));
       }
     }
 
     $form
       ->appendChild($control);
 
     $submit_control = id(new AphrontFormSubmitControl())
       ->addCancelButton($done_uri);
 
     if (!$option->getLocked()) {
       $submit_control->setValue(pht('Save Config Entry'));
     }
 
     $form->appendChild($submit_control);
 
     $examples = $this->renderExamples($option);
     if ($examples) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Examples'))
           ->setValue($examples));
     }
 
     if (!$option->getHidden()) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Default'))
           ->setValue($this->renderDefaults($option)));
     }
 
     $title = pht('Edit %s', $this->key);
     $short = pht('Edit');
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormError($error_view)
       ->setForm($form);
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addCrumb(
       id(new PhabricatorCrumbView())
         ->setName(pht('Config'))
         ->setHref($this->getApplicationURI()));
 
     if ($group) {
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName($group->getName())
           ->setHref($group_uri));
     }
 
     $crumbs->addCrumb(
       id(new PhabricatorCrumbView())
         ->setName($this->key)
         ->setHref('/config/edit/'.$this->key));
 
     $xactions = id(new PhabricatorConfigTransactionQuery())
       ->withObjectPHIDs(array($config_entry->getPHID()))
       ->setViewer($user)
       ->execute();
 
     $xaction_view = id(new PhabricatorApplicationTransactionView())
       ->setUser($user)
       ->setObjectPHID($config_entry->getPHID())
       ->setTransactions($xactions);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
         $xaction_view,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
   private function readRequest(
     PhabricatorConfigOption $option,
     AphrontRequest $request) {
 
     $xaction = new PhabricatorConfigTransaction();
     $xaction->setTransactionType(PhabricatorConfigTransaction::TYPE_EDIT);
 
     $e_value = null;
     $errors = array();
 
     $value = $request->getStr('value');
     if (!strlen($value)) {
       $value = null;
 
       $xaction->setNewValue(
         array(
           'deleted' => true,
           'value'   => null,
         ));
 
       return array($e_value, $errors, $value, $xaction);
     }
 
     if ($option->isCustomType()) {
       $info = $option->getCustomObject()->readRequest($option, $request);
       list($e_value, $errors, $set_value, $value) = $info;
     } else {
       $type = $option->getType();
       $set_value = null;
 
       switch ($type) {
         case 'int':
           if (preg_match('/^-?[0-9]+$/', trim($value))) {
             $set_value = (int)$value;
           } else {
             $e_value = pht('Invalid');
             $errors[] = pht('Value must be an integer.');
           }
           break;
         case 'string':
         case 'enum':
           $set_value = (string)$value;
           break;
         case 'list<string>':
         case 'list<regex>':
           $set_value = phutil_split_lines(
             $request->getStr('value'),
             $retain_endings = false);
 
           foreach ($set_value as $key => $v) {
             if (!strlen($v)) {
               unset($set_value[$key]);
             }
           }
           $set_value = array_values($set_value);
 
           break;
         case 'set':
           $set_value = array_fill_keys($request->getStrList('value'), true);
           break;
         case 'bool':
           switch ($value) {
             case 'true':
               $set_value = true;
               break;
             case 'false':
               $set_value = false;
               break;
             default:
               $e_value = pht('Invalid');
               $errors[] = pht('Value must be boolean, "true" or "false".');
               break;
           }
           break;
         case 'class':
           if (!class_exists($value)) {
             $e_value = pht('Invalid');
             $errors[] = pht('Class does not exist.');
           } else {
             $base = $option->getBaseClass();
             if (!is_subclass_of($value, $base)) {
               $e_value = pht('Invalid');
               $errors[] = pht('Class is not of valid type.');
             } else {
               $set_value = $value;
             }
           }
           break;
         default:
           $json = json_decode($value, true);
           if ($json === null && strtolower($value) != 'null') {
             $e_value = pht('Invalid');
             $errors[] = pht(
               'The given value must be valid JSON. This means, among '.
               'other things, that you must wrap strings in double-quotes.');
           } else {
             $set_value = $json;
           }
           break;
       }
     }
 
     if (!$errors) {
       $xaction->setNewValue(
         array(
           'deleted' => false,
           'value'   => $set_value,
         ));
     } else {
       $xaction = null;
     }
 
     return array($e_value, $errors, $value, $xaction);
   }
 
   private function getDisplayValue(
     PhabricatorConfigOption $option,
     PhabricatorConfigEntry $entry) {
 
     if ($entry->getIsDeleted()) {
       return null;
     }
 
     if ($option->isCustomType()) {
       return $option->getCustomObject()->getDisplayValue($option, $entry);
     } else {
       $type = $option->getType();
       $value = $entry->getValue();
       switch ($type) {
         case 'int':
         case 'string':
         case 'enum':
         case 'class':
           return $value;
         case 'bool':
           return $value ? 'true' : 'false';
         case 'list<string>':
         case 'list<regex>':
           return implode("\n", nonempty($value, array()));
         case 'set':
           return implode("\n", nonempty(array_keys($value), array()));
         default:
           return PhabricatorConfigJSON::prettyPrintJSON($value);
       }
     }
   }
 
   private function renderControl(
     PhabricatorConfigOption $option,
     $display_value,
     $e_value) {
 
     if ($option->isCustomType()) {
       $control = $option->getCustomObject()->renderControl(
         $option,
         $display_value,
         $e_value);
     } else {
       $type = $option->getType();
       switch ($type) {
         case 'int':
         case 'string':
           $control = id(new AphrontFormTextControl());
           break;
         case 'bool':
           $control = id(new AphrontFormSelectControl())
             ->setOptions(
               array(
                 ''      => pht('(Use Default)'),
                 'true'  => idx($option->getBoolOptions(), 0),
                 'false' => idx($option->getBoolOptions(), 1),
               ));
           break;
         case 'enum':
           $options = array_mergev(
             array(
               array('' => pht('(Use Default)')),
               $option->getEnumOptions(),
             ));
           $control = id(new AphrontFormSelectControl())
             ->setOptions($options);
           break;
         case 'class':
           $symbols = id(new PhutilSymbolLoader())
             ->setType('class')
             ->setAncestorClass($option->getBaseClass())
             ->setConcreteOnly(true)
             ->selectSymbolsWithoutLoading();
           $names = ipull($symbols, 'name', 'name');
           asort($names);
           $names = array(
             '' => pht('(Use Default)'),
           ) + $names;
 
           $control = id(new AphrontFormSelectControl())
             ->setOptions($names);
           break;
         case 'list<string>':
         case 'list<regex>':
           $control = id(new AphrontFormTextAreaControl())
             ->setCaption(pht('Separate values with newlines.'));
           break;
         case 'set':
           $control = id(new AphrontFormTextAreaControl())
             ->setCaption(pht('Separate values with newlines or commas.'));
           break;
         default:
           $control = id(new AphrontFormTextAreaControl())
             ->setHeight(AphrontFormTextAreaControl::HEIGHT_VERY_TALL)
             ->setCustomClass('PhabricatorMonospaced')
             ->setCaption(pht('Enter value in JSON.'));
           break;
       }
 
       $control
         ->setLabel(pht('Value'))
         ->setError($e_value)
         ->setValue($display_value)
         ->setName('value');
     }
 
     if ($option->getLocked()) {
       $control->setDisabled(true);
     }
 
     return $control;
   }
 
   private function renderExamples(PhabricatorConfigOption $option) {
     $examples = $option->getExamples();
     if (!$examples) {
       return null;
     }
 
     $table = array();
     $table[] = phutil_tag('tr', array('class' => 'column-labels'), array(
       phutil_tag('th', array(), pht('Example')),
       phutil_tag('th', array(), pht('Value')),
     ));
     foreach ($examples as $example) {
       list($value, $description) = $example;
 
       if ($value === null) {
         $value = phutil_tag('em', array(), pht('(empty)'));
       } else {
         if (is_array($value)) {
           $value = implode("\n", $value);
         }
       }
 
       $table[] = phutil_tag('tr', array(), array(
         phutil_tag('th', array(), $description),
-        phutil_tag('th', array(), $value),
+        phutil_tag('td', array(), $value),
       ));
     }
 
     require_celerity_resource('config-options-css');
 
     return phutil_tag(
       'table',
       array(
         'class' => 'config-option-table',
       ),
       $table);
   }
 
   private function renderDefaults(PhabricatorConfigOption $option) {
     $stack = PhabricatorEnv::getConfigSourceStack();
     $stack = $stack->getStack();
 
     $table = array();
     $table[] = phutil_tag('tr', array('class' => 'column-labels'), array(
       phutil_tag('th', array(), pht('Source')),
       phutil_tag('th', array(), pht('Value')),
     ));
     foreach ($stack as $key => $source) {
       $value = $source->getKeys(
         array(
           $option->getKey(),
         ));
 
       if (!array_key_exists($option->getKey(), $value)) {
         $value = phutil_tag('em', array(), pht('(empty)'));
       } else {
         $value = PhabricatorConfigJSON::prettyPrintJSON(
           $value[$option->getKey()]);
       }
 
       $table[] = phutil_tag('tr', array('class' => 'column-labels'), array(
         phutil_tag('th', array(), $source->getName()),
         phutil_tag('td', array(), $value),
       ));
     }
 
     require_celerity_resource('config-options-css');
 
     return phutil_tag(
       'table',
       array(
         'class' => 'config-option-table',
       ),
       $table);
   }
 
 }
diff --git a/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php b/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
index dffe91e7b..dac2dbfb3 100644
--- a/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
+++ b/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
@@ -1,95 +1,118 @@
 <?php
 
 final class PhabricatorAuthenticationConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht("Authentication");
   }
 
   public function getDescription() {
     return pht("Options relating to authentication.");
   }
 
   public function getOptions() {
     return array(
       $this->newOption('auth.sessions.web', 'int', 5)
         ->setSummary(
           pht("Number of web sessions a user can have simultaneously."))
         ->setDescription(
           pht(
             "Maximum number of simultaneous web sessions each user is ".
             "permitted to have. Setting this to '1' will prevent a user from ".
             "logging in on more than one browser at the same time.")),
-     $this->newOption('auth.sessions.conduit', 'int', 5)
+      $this->newOption('auth.sessions.conduit', 'int', 5)
         ->setSummary(
           pht(
             "Number of simultaneous Conduit sessions each user is permitted."))
         ->setDescription(
           pht(
             "Maximum number of simultaneous Conduit sessions each user is ".
             "permitted to have.")),
-     $this->newOption('auth.require-email-verification', 'bool', false)
+      $this->newOption('auth.require-email-verification', 'bool', false)
         ->setBoolOptions(
           array(
             pht("Require email verification"),
             pht("Don't require email verification")
           ))
         ->setSummary(
           pht("Require email verification before a user can log in."))
         ->setDescription(
           pht(
             "If true, email addresses must be verified (by clicking a link ".
             "in an email) before a user can login. By default, verification ".
-            "is optional unless 'auth.email-domains' is nonempty.")),
-     $this->newOption('auth.email-domains', 'list<string>', array())
+            "is optional unless {{auth.email-domains}} is nonempty.")),
+      $this->newOption('auth.require-approval', 'bool', true)
+        ->setBoolOptions(
+          array(
+            pht("Require Administrators to Approve Accounts"),
+            pht("Don't Require Manual Approval"),
+          ))
+        ->setSummary(
+          pht("Require administrators to approve new accounts."))
+        ->setDescription(
+          pht(
+            "Newly registered Phabricator accounts can either be placed ".
+            "into a manual approval queue for administrative review, or ".
+            "automatically activated immediately. The approval queue is ".
+            "enabled by default because it gives you greater control over ".
+            "who can register an account and access Phabricator.\n\n".
+            "If your install is completely public, or on a VPN, or users can ".
+            "only register with a trusted provider like LDAP, or you've ".
+            "otherwise configured Phabricator to prevent unauthorized ".
+            "registration, you can disable the queue to reduce administrative ".
+            "overhead.\n\n".
+            "NOTE: Before you disable the queue, make sure ".
+            "{{auth.email-domains}} is configured correctly for your ".
+            "install!")),
+      $this->newOption('auth.email-domains', 'list<string>', array())
         ->setSummary(pht("Only allow registration from particular domains."))
         ->setDescription(
           pht(
             "You can restrict allowed email addresses to certain domains ".
-            "(like 'yourcompany.com') by setting a list of allowed domains ".
-            "here. Users will only be allowed to register using email ".
+            "(like `yourcompany.com`) by setting a list of allowed domains ".
+            "here.\n\nUsers will only be allowed to register using email ".
             "addresses at one of the domains, and will only be able to add ".
             "new email addresses for these domains. If you configure this, ".
-            "it implies 'auth.require-email-verification'.\n\n".
-            "You should omit the '@' from domains. Note that the domain must ".
-            "match exactly. If you allow 'yourcompany.com', that permits ".
-            "'joe@yourcompany.com' but rejects 'joe@mail.yourcompany.com'."))
+            "it implies {{auth.require-email-verification}}.\n\n".
+            "You should omit the `@` from domains. Note that the domain must ".
+            "match exactly. If you allow `yourcompany.com`, that permits ".
+            "`joe@yourcompany.com` but rejects `joe@mail.yourcompany.com`."))
         ->addExample(
           "yourcompany.com\nmail.yourcompany.com",
           pht('Valid Setting')),
-     $this->newOption('auth.login-message', 'string', null)
+      $this->newOption('auth.login-message', 'string', null)
         ->setLocked(true)
         ->setSummary(pht("A block of HTML displayed on the login screen."))
         ->setDescription(
           pht(
             "You can provide an arbitrary block of HTML here, which will ".
             "appear on the login screen. Normally, you'd use this to provide ".
             "login or registration instructions to users.")),
-     $this->newOption('account.editable', 'bool', true)
+      $this->newOption('account.editable', 'bool', true)
         ->setBoolOptions(
           array(
             pht("Allow editing"),
             pht("Prevent editing")
           ))
         ->setSummary(
           pht(
             "Determines whether or not basic account information is ".
             "editable."))
         ->setDescription(
           pht(
             "Is basic account information (email, real name, profile ".
             "picture) editable? If you set up Phabricator to automatically ".
             "synchronize account information from some other authoritative ".
             "system, you can disable this to ensure information remains ".
             "consistent across both systems.")),
-     $this->newOption('account.minimum-password-length', 'int', 8)
+      $this->newOption('account.minimum-password-length', 'int', 8)
         ->setSummary(pht("Minimum password length."))
         ->setDescription(
           pht(
             "When users set or reset a password, it must have at least this ".
             "many characters.")),
     );
   }
 
 }
diff --git a/src/applications/people/controller/PhabricatorPeopleEditController.php b/src/applications/people/controller/PhabricatorPeopleEditController.php
index 904402dfb..f0203edcd 100644
--- a/src/applications/people/controller/PhabricatorPeopleEditController.php
+++ b/src/applications/people/controller/PhabricatorPeopleEditController.php
@@ -1,838 +1,841 @@
 <?php
 
 final class PhabricatorPeopleEditController
   extends PhabricatorPeopleController {
 
   private $id;
   private $view;
 
   public function willProcessRequest(array $data) {
     $this->id = idx($data, 'id');
     $this->view = idx($data, 'view');
   }
 
   public function processRequest() {
 
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $crumbs = $this->buildApplicationCrumbs($this->buildSideNavView());
     if ($this->id) {
       $user = id(new PhabricatorUser())->load($this->id);
       if (!$user) {
         return new Aphront404Response();
       }
       $base_uri = '/people/edit/'.$user->getID().'/';
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName(pht('Edit User'))
           ->setHref('/people/edit/'));
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName($user->getFullName())
           ->setHref($base_uri));
     } else {
       $user = new PhabricatorUser();
       $base_uri = '/people/edit/';
       $crumbs->addCrumb(
         id(new PhabricatorCrumbView())
           ->setName(pht('Create New User'))
           ->setHref($base_uri));
     }
 
     $nav = new AphrontSideNavFilterView();
     $nav->setBaseURI(new PhutilURI($base_uri));
     $nav->addLabel(pht('User Information'));
     $nav->addFilter('basic', pht('Basic Information'));
     $nav->addFilter('role', pht('Edit Roles'));
     $nav->addFilter('cert', pht('Conduit Certificate'));
     $nav->addFilter('profile',
       pht('View Profile'), '/p/'.$user->getUsername().'/');
     $nav->addLabel(pht('Special'));
     $nav->addFilter('rename', pht('Change Username'));
     if ($user->getIsSystemAgent()) {
       $nav->addFilter('picture', pht('Set Account Picture'));
     }
     $nav->addFilter('delete', pht('Delete User'));
 
     if (!$user->getID()) {
       $this->view = 'basic';
     }
 
     $view = $nav->selectFilter($this->view, 'basic');
 
     $content = array();
 
     if ($request->getStr('saved')) {
       $notice = new AphrontErrorView();
       $notice->setSeverity(AphrontErrorView::SEVERITY_NOTICE);
       $notice->setTitle(pht('Changes Saved'));
       $notice->appendChild(
         phutil_tag('p', array(), pht('Your changes were saved.')));
       $content[] = $notice;
     }
 
     switch ($view) {
       case 'basic':
         $response = $this->processBasicRequest($user);
         break;
       case 'role':
         $response = $this->processRoleRequest($user);
         break;
       case 'cert':
         $response = $this->processCertificateRequest($user);
         break;
       case 'rename':
         $response = $this->processRenameRequest($user);
         break;
       case 'picture':
         $response = $this->processSetAccountPicture($user);
         break;
       case 'delete':
         $response = $this->processDeleteRequest($user);
         break;
       default:
         return new Aphront404Response();
     }
 
     if ($response instanceof AphrontResponse) {
       return $response;
     }
 
     $content[] = $response;
 
     if ($user->getID()) {
       $nav->appendChild($content);
     } else {
       $nav = $this->buildSideNavView();
       $nav->selectFilter('edit');
       $nav->appendChild($content);
     }
 
     $nav->setCrumbs($crumbs);
     return $this->buildApplicationPage(
       $nav,
       array(
         'title' => pht('Edit User'),
         'device' => true,
       ));
   }
 
   private function processBasicRequest(PhabricatorUser $user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $e_username = true;
     $e_realname = true;
     $e_email    = true;
     $errors = array();
 
     $welcome_checked = true;
 
     $new_email = null;
 
     $request = $this->getRequest();
     if ($request->isFormPost()) {
       $welcome_checked = $request->getInt('welcome');
       $is_new = !$user->getID();
 
       if ($is_new) {
         $user->setUsername($request->getStr('username'));
 
         $new_email = $request->getStr('email');
         if (!strlen($new_email)) {
           $errors[] = pht('Email is required.');
           $e_email = pht('Required');
         } else if (!PhabricatorUserEmail::isAllowedAddress($new_email)) {
           $e_email = pht('Invalid');
           $errors[] = PhabricatorUserEmail::describeAllowedAddresses();
         } else {
           $e_email = null;
         }
 
       }
       $user->setRealName($request->getStr('realname'));
 
       if (!strlen($user->getUsername())) {
         $errors[] = pht("Username is required.");
         $e_username = pht('Required');
       } else if (!PhabricatorUser::validateUsername($user->getUsername())) {
         $errors[] = PhabricatorUser::describeValidUsername();
         $e_username = pht('Invalid');
       } else {
         $e_username = null;
       }
 
       if (!strlen($user->getRealName())) {
         $errors[] = pht('Real name is required.');
         $e_realname = pht('Required');
       } else {
         $e_realname = null;
       }
 
       if (!$errors) {
         try {
 
           if (!$is_new) {
             id(new PhabricatorUserEditor())
               ->setActor($admin)
               ->updateUser($user);
           } else {
             $email = id(new PhabricatorUserEmail())
               ->setAddress($new_email)
               ->setIsVerified(0);
 
+            // Automatically approve the user, since an admin is creating them.
+            $user->setIsApproved(1);
+
             id(new PhabricatorUserEditor())
               ->setActor($admin)
               ->createNewUser($user, $email);
 
             if ($request->getStr('role') == 'agent') {
               id(new PhabricatorUserEditor())
                 ->setActor($admin)
                 ->makeSystemAgentUser($user, true);
             }
 
           }
 
           if ($welcome_checked) {
             $user->sendWelcomeEmail($admin);
           }
 
           $response = id(new AphrontRedirectResponse())
             ->setURI('/people/edit/'.$user->getID().'/?saved=true');
           return $response;
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $errors[] = pht('Username and email must be unique.');
 
           $same_username = id(new PhabricatorUser())
             ->loadOneWhere('username = %s', $user->getUsername());
           $same_email = id(new PhabricatorUserEmail())
             ->loadOneWhere('address = %s', $new_email);
 
           if ($same_username) {
             $e_username = pht('Duplicate');
           }
 
           if ($same_email) {
             $e_email = pht('Duplicate');
           }
         }
       }
     }
 
     $error_view = null;
     if ($errors) {
       $error_view = id(new AphrontErrorView())
         ->setTitle(pht('Form Errors'))
         ->setErrors($errors);
     }
 
     $form = new AphrontFormView();
     $form->setUser($admin);
     if ($user->getID()) {
       $form->setAction('/people/edit/'.$user->getID().'/');
     } else {
       $form->setAction('/people/edit/');
     }
 
     if ($user->getID()) {
       $is_immutable = true;
     } else {
       $is_immutable = false;
     }
 
     $form
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Username'))
           ->setName('username')
           ->setValue($user->getUsername())
           ->setError($e_username)
           ->setDisabled($is_immutable))
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Real Name'))
           ->setName('realname')
           ->setValue($user->getRealName())
           ->setError($e_realname));
 
     if (!$user->getID()) {
       $form->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Email'))
           ->setName('email')
           ->setDisabled($is_immutable)
           ->setValue($new_email)
           ->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
           ->setError($e_email));
     } else {
       $email = $user->loadPrimaryEmail();
       if ($email) {
         $status = $email->getIsVerified() ?
           pht('Verified') : pht('Unverified');
       } else {
         $status = pht('No Email Address');
       }
 
       $form->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Email'))
           ->setValue($status));
 
       $form->appendChild(
         id(new AphrontFormCheckboxControl())
         ->addCheckbox(
           'welcome',
           1,
           pht('Re-send "Welcome to Phabricator" email.'),
           false));
 
     }
 
     $form->appendChild($this->getRoleInstructions());
 
     if (!$user->getID()) {
       $form
         ->appendChild(
           id(new AphrontFormSelectControl())
             ->setLabel(pht('Role'))
             ->setName('role')
             ->setValue('user')
             ->setOptions(
               array(
                 'user'  => pht('Normal User'),
                 'agent' => pht('System Agent'),
               ))
             ->setCaption(
               pht('You can create a "system agent" account for bots, '.
               'scripts, etc.')))
         ->appendChild(
           id(new AphrontFormCheckboxControl())
             ->addCheckbox(
               'welcome',
               1,
               pht('Send "Welcome to Phabricator" email.'),
               $welcome_checked));
     } else {
       $roles = array();
 
       if ($user->getIsSystemAgent()) {
         $roles[] = pht('System Agent');
       }
       if ($user->getIsAdmin()) {
         $roles[] = pht('Admin');
       }
       if ($user->getIsDisabled()) {
         $roles[] = pht('Disabled');
       }
       if (!$user->getIsApproved()) {
         $roles[] = pht('Not Approved');
       }
       if (!$roles) {
         $roles[] = pht('Normal User');
       }
 
       $roles = implode(', ', $roles);
 
       $form->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Roles'))
           ->setValue($roles));
     }
 
     $form
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Save')));
 
     if ($user->getID()) {
       $title = pht('Edit User');
     } else {
       $title = pht('Create New User');
     }
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormError($error_view)
       ->setForm($form);
 
     return array($form_box);
   }
 
   private function processRoleRequest(PhabricatorUser $user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $is_self = ($user->getID() == $admin->getID());
 
     $errors = array();
 
     if ($request->isFormPost()) {
 
       $log_template = PhabricatorUserLog::newLog(
         $admin,
         $user,
         null);
 
       $logs = array();
 
       if ($is_self) {
         $errors[] = pht("You can not edit your own role.");
       } else {
         $new_admin = (bool)$request->getBool('is_admin');
         $old_admin = (bool)$user->getIsAdmin();
         if ($new_admin != $old_admin) {
           id(new PhabricatorUserEditor())
             ->setActor($admin)
             ->makeAdminUser($user, $new_admin);
         }
 
         $new_disabled = (bool)$request->getBool('is_disabled');
         $old_disabled = (bool)$user->getIsDisabled();
         if ($new_disabled != $old_disabled) {
           id(new PhabricatorUserEditor())
             ->setActor($admin)
             ->disableUser($user, $new_disabled);
         }
       }
 
       if (!$errors) {
         return id(new AphrontRedirectResponse())
           ->setURI($request->getRequestURI()->alter('saved', 'true'));
       }
     }
 
     $error_view = null;
     if ($errors) {
       $error_view = id(new AphrontErrorView())
         ->setTitle(pht('Form Errors'))
         ->setErrors($errors);
     }
 
 
     $form = id(new AphrontFormView())
       ->setUser($admin)
       ->setAction($request->getRequestURI()->alter('saved', null));
 
     if ($is_self) {
       $inst = pht('NOTE: You can not edit your own role.');
       $form->appendChild(
         phutil_tag('p', array('class' => 'aphront-form-instructions'), $inst));
     }
 
     $form
       ->appendChild($this->getRoleInstructions())
       ->appendChild(
         id(new AphrontFormCheckboxControl())
           ->addCheckbox(
             'is_admin',
             1,
             pht('Administrator'),
             $user->getIsAdmin())
           ->setDisabled($is_self))
       ->appendChild(
         id(new AphrontFormCheckboxControl())
           ->addCheckbox(
             'is_disabled',
             1,
             pht('Disabled'),
             $user->getIsDisabled())
           ->setDisabled($is_self))
       ->appendChild(
         id(new AphrontFormCheckboxControl())
           ->addCheckbox(
             'is_agent',
             1,
             pht('System Agent (Bot/Script User)'),
             $user->getIsSystemAgent())
           ->setDisabled(true));
 
     if (!$is_self) {
       $form
         ->appendChild(
           id(new AphrontFormSubmitControl())
             ->setValue(pht('Edit Role')));
     }
 
     $title = pht('Edit Role');
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormError($error_view)
       ->setForm($form);
 
     return array($form_box);
   }
 
   private function processCertificateRequest($user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $inst = pht('You can use this certificate '.
         'to write scripts or bots which interface with Phabricator over '.
         'Conduit.');
     $form = new AphrontFormView();
     $form
       ->setUser($admin)
       ->setAction($request->getRequestURI())
       ->appendChild(
         phutil_tag('p', array('class' => 'aphront-form-instructions'), $inst));
 
     if ($user->getIsSystemAgent()) {
       $form
         ->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('Username'))
             ->setValue($user->getUsername()))
         ->appendChild(
           id(new AphrontFormTextAreaControl())
             ->setLabel(pht('Certificate'))
             ->setValue($user->getConduitCertificate()));
     } else {
       $form->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Certificate'))
           ->setValue(
             pht('You may only view the certificates of System Agents.')));
     }
 
     $title = pht('Conduit Certificate');
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setForm($form);
 
     return array($form_box);
   }
 
   private function processRenameRequest(PhabricatorUser $user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $e_username = true;
     $username = $user->getUsername();
 
     $errors = array();
     if ($request->isFormPost()) {
 
       $username = $request->getStr('username');
       if (!strlen($username)) {
         $e_username = pht('Required');
         $errors[] = pht('New username is required.');
       } else if ($username == $user->getUsername()) {
         $e_username = pht('Invalid');
         $errors[] = pht('New username must be different from old username.');
       } else if (!PhabricatorUser::validateUsername($username)) {
         $e_username = pht('Invalid');
         $errors[] = PhabricatorUser::describeValidUsername();
       }
 
       if (!$errors) {
         try {
 
           id(new PhabricatorUserEditor())
             ->setActor($admin)
             ->changeUsername($user, $username);
 
           return id(new AphrontRedirectResponse())
             ->setURI($request->getRequestURI()->alter('saved', true));
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $e_username = pht('Not Unique');
           $errors[] = pht('Another user already has that username.');
         }
       }
     }
 
     if ($errors) {
       $errors = id(new AphrontErrorView())
         ->setTitle(pht('Form Errors'))
         ->setErrors($errors);
     } else {
       $errors = null;
     }
 
     $inst1 = pht('Be careful when renaming users!');
     $inst2 = pht('The old username will no longer be tied to the user, so '.
           'anything which uses it (like old commit messages) will no longer '.
           'associate correctly. And if you give a user a username which some '.
           'other user used to have, username lookups will begin returning '.
           'the wrong user.');
     $inst3 = pht('It is generally safe to rename newly created users (and '.
           'test users and so on), but less safe to rename established users '.
           'and unsafe to reissue a username.');
     $inst4 = pht('Users who rely on password auth will need to reset their '.
           'passwordafter their username is changed (their username is part '.
           'of the salt in the password hash). They will receive an email '.
           'with instructions on how to do this.');
 
     $form = new AphrontFormView();
     $form
       ->setUser($admin)
       ->setAction($request->getRequestURI())
       ->appendChild(hsprintf(
         '<p class="aphront-form-instructions">'.
           '<strong>%s</strong> '.
           '%s'.
         '</p>'.
         '<p class="aphront-form-instructions">'.
           '%s'.
         '</p>'.
         '<p class="aphront-form-instructions">'.
           '%s'.
         '</p>', $inst1, $inst2, $inst3, $inst4))
       ->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Old Username'))
           ->setValue($user->getUsername()))
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('New Username'))
           ->setValue($username)
           ->setName('username')
           ->setError($e_username))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Change Username')));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Change Username'))
       ->setFormError($errors)
       ->setForm($form);
 
     return array($form_box);
   }
 
   private function processDeleteRequest(PhabricatorUser $user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $far1 = pht('As you stare into the gaping maw of the abyss, something '.
         'hold you back.');
     $far2 = pht('You can not delete your own account.');
 
     if ($user->getPHID() == $admin->getPHID()) {
       $error = new AphrontErrorView();
       $error->setTitle(pht('You Shall Journey No Farther'));
       $error->appendChild(hsprintf(
         '<p>%s</p><p>%s</p>', $far1, $far2));
       return $error;
     }
 
     $e_username = true;
     $username = null;
 
     $errors = array();
     if ($request->isFormPost()) {
 
       $username = $request->getStr('username');
       if (!strlen($username)) {
         $e_username = pht('Required');
         $errors[] = pht('You must type the username to confirm deletion.');
       } else if ($username != $user->getUsername()) {
         $e_username = pht('Invalid');
         $errors[] = pht('You must type the username correctly.');
       }
 
       if (!$errors) {
         id(new PhabricatorUserEditor())
           ->setActor($admin)
           ->deleteUser($user);
 
         return id(new AphrontRedirectResponse())->setURI('/people/');
       }
     }
 
     if ($errors) {
       $errors = id(new AphrontErrorView())
         ->setTitle(pht('Form Errors'))
         ->setErrors($errors);
     } else {
       $errors = null;
     }
 
     $str1 = pht('Be careful when deleting users!');
     $str2 = pht('If this user interacted with anything, it is generally '.
         'better to disable them, not delete them. If you delete them, it will '.
         'no longer be possible to search for their objects, for example, '.
         'and you will lose other information about their history. Disabling '.
         'them instead will prevent them from logging in but not destroy '.
         'any of their data.');
     $str3 = pht('It is generally safe to delete newly created users (and '.
           'test users and so on), but less safe to delete established users. '.
           'If possible, disable them instead.');
 
     $form = new AphrontFormView();
     $form
       ->setUser($admin)
       ->setAction($request->getRequestURI())
       ->appendChild(hsprintf(
         '<p class="aphront-form-instructions">'.
           '<strong>%s</strong> %s'.
         '</p>'.
         '<p class="aphront-form-instructions">'.
           '%s'.
         '</p>', $str1, $str2, $str3))
       ->appendChild(
         id(new AphrontFormStaticControl())
           ->setLabel(pht('Username'))
           ->setValue($user->getUsername()))
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Confirm'))
           ->setValue($username)
           ->setName('username')
           ->setCaption(pht("Type the username again to confirm deletion."))
           ->setError($e_username))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Delete User')));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Delete User'))
       ->setFormError($errors)
       ->setForm($form);
 
     return array($form_box);
   }
 
   private function getRoleInstructions() {
     $roles_link = phutil_tag(
       'a',
       array(
         'href'   => PhabricatorEnv::getDoclink(
           'article/User_Guide_Account_Roles.html'),
         'target' => '_blank',
       ),
       pht('User Guide: Account Roles'));
 
     return phutil_tag(
       'p',
       array('class' => 'aphront-form-instructions'),
       pht('For a detailed explanation of account roles, see %s.', $roles_link));
   }
 
   private function processSetAccountPicture(PhabricatorUser $user) {
     $request = $this->getRequest();
     $admin = $request->getUser();
 
     $profile = $user->loadUserProfile();
     if (!$profile->getID()) {
       $profile->setTitle('');
       $profile->setBlurb('');
     }
 
 
 
     $supported_formats = PhabricatorFile::getTransformableImageFormats();
 
     $e_image = null;
     $errors = array();
 
     if ($request->isFormPost()) {
       $default_image = $request->getExists('default_image');
 
       if ($default_image) {
         $profile->setProfileImagePHID(null);
         $user->setProfileImagePHID(null);
       } else if ($request->getFileExists('image')) {
         $file = null;
         $file = PhabricatorFile::newFromPHPUpload(
           $_FILES['image'],
           array(
             'authorPHID' => $admin->getPHID(),
           ));
 
         $okay = $file->isTransformableImage();
 
         if ($okay) {
           $xformer = new PhabricatorImageTransformer();
 
           // Generate the large picture for the profile page.
           $large_xformed = $xformer->executeProfileTransform(
             $file,
             $width = 280,
             $min_height = 140,
             $max_height = 420);
           $profile->setProfileImagePHID($large_xformed->getPHID());
 
           // Generate the small picture for comments, etc.
           $small_xformed = $xformer->executeProfileTransform(
             $file,
             $width = 50,
             $min_height = 50,
             $max_height = 50);
           $user->setProfileImagePHID($small_xformed->getPHID());
         } else {
           $e_image = pht('Not Supported');
           $errors[] =
             pht('This server only supports these image formats:').
               ' ' .implode(', ', $supported_formats);
         }
       }
 
      if (!$errors) {
        $user->save();
        $profile->save();
         $response = id(new AphrontRedirectResponse())
           ->setURI('/people/edit/'.$user->getID().'/picture/');
         return $response;
       }
     }
 
 
     $error_view = null;
     if ($errors) {
       $error_view = new AphrontErrorView();
       $error_view->setTitle(pht('Form Errors'));
       $error_view->setErrors($errors);
     } else {
       if ($request->getStr('saved')) {
         $error_view = new AphrontErrorView();
         $error_view->setSeverity(AphrontErrorView::SEVERITY_NOTICE);
         $error_view->setTitle(pht('Changes Saved'));
         $error_view->appendChild(
           phutil_tag('p', array(), pht('Your changes have been saved.')));
         $error_view = $error_view->render();
       }
     }
 
     $img_src = $user->loadProfileImageURI();
 
     $form = new AphrontFormView();
     $form
       ->setUser($admin)
       ->setAction($request->getRequestURI())
       ->setEncType('multipart/form-data')
       ->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Profile Image'))
           ->setValue(
             phutil_tag(
               'img',
               array(
                 'src' => $img_src,
               ))))
       ->appendChild(
         id(new AphrontFormImageControl())
           ->setLabel(pht('Change Image'))
           ->setName('image')
           ->setError($e_image)
           ->setCaption(
             pht('Supported formats: %s', implode(', ', $supported_formats))));
 
       $form->appendChild(
       id(new AphrontFormSubmitControl())
         ->setValue(pht('Save'))
         ->addCancelButton('/people/edit/'.$user->getID().'/'));
 
     $panel = new AphrontPanelView();
     $panel->setHeader(pht('Set Profile Picture'));
     $panel->setWidth(AphrontPanelView::WIDTH_FORM);
     $panel->setNoBackground();
     $panel->appendChild($form);
 
     return array($error_view, $panel);
 
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index 503407271..974a60b2b 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,900 +1,900 @@
 <?php
 
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $sex;
   protected $translation;
   protected $passwordSalt;
   protected $passwordHash;
   protected $profileImagePHID;
   protected $timezoneIdentifier = '';
 
   protected $consoleEnabled = 0;
   protected $consoleVisible = 0;
   protected $consoleTab = '';
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
-  protected $isApproved = 1;
+  protected $isApproved = 0;
 
   private $profileImage = null;
   private $profile = null;
   private $status = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       case 'timezoneIdentifier':
         // If the user hasn't set one, guess the server's time.
         return nonempty(
           $this->timezoneIdentifier,
           date_default_timezone_get());
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
   public function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_PARTIAL_OBJECTS => true,
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeoplePHIDTypeUser::TYPECONST);
   }
 
   public function setPassword(PhutilOpaqueEnvelope $envelope) {
     if (!$this->getPHID()) {
       throw new Exception(
         "You can not set a password for an unsaved user because their PHID ".
         "is a salt component in the password hash.");
     }
 
     if (!strlen($envelope->openEnvelope())) {
       $this->setPasswordHash('');
     } else {
       $this->setPasswordSalt(md5(mt_rand()));
       $hash = $this->hashPassword($envelope);
       $this->setPasswordHash($hash);
     }
     return $this;
   }
 
   // To satisfy PhutilPerson.
   public function getSex() {
     return $this->sex;
   }
 
   public function getTranslation() {
     try {
       if ($this->translation &&
           class_exists($this->translation) &&
           is_subclass_of($this->translation, 'PhabricatorTranslation')) {
         return $this->translation;
       }
     } catch (PhutilMissingSymbolException $ex) {
       return null;
     }
     return null;
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
     $result = parent::save();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     id(new PhabricatorSearchIndexer())
       ->indexDocumentByPHID($this->getPHID());
 
     return $result;
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   public function comparePassword(PhutilOpaqueEnvelope $envelope) {
     if (!strlen($envelope->openEnvelope())) {
       return false;
     }
     if (!strlen($this->getPasswordHash())) {
       return false;
     }
     $password_hash = $this->hashPassword($envelope);
     return ($password_hash === $this->getPasswordHash());
   }
 
   private function hashPassword(PhutilOpaqueEnvelope $envelope) {
     $hash = $this->getUsername().
             $envelope->openEnvelope().
             $this->getPHID().
             $this->getPasswordSalt();
     for ($ii = 0; $ii < 1000; $ii++) {
       $hash = md5($hash);
     }
     return $hash;
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   public function getCSRFToken() {
     $salt = PhabricatorStartup::getGlobal('csrf.salt');
     if (!$salt) {
       $salt = Filesystem::readRandomCharacters(self::CSRF_SALT_LENGTH);
       PhabricatorStartup::setGlobal('csrf.salt', $salt);
     }
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
     $hash = PhabricatorHash::digest($token, $salt);
     return 'B@'.$salt.substr($hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
     if (!$this->getPHID()) {
       return true;
     }
 
     $salt = null;
 
     $version = 'plain';
 
     // This is a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
 
     if (!strncmp($token, $breach_prefix, $breach_prelen)) {
       $version = 'breach';
       $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
       $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
     }
 
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
       switch ($version) {
         // TODO: We can remove this after the BREACH version has been in the
         // wild for a while.
         case 'plain':
           if ($token == $valid) {
             return true;
           }
           break;
         case 'breach':
           $digest = PhabricatorHash::digest($valid, $salt);
           if (substr($digest, 0, self::CSRF_TOKEN_LENGTH) == $token) {
             return true;
           }
           break;
         default:
           throw new Exception("Unknown CSRF token format!");
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     $time_block = floor($epoch / $frequency);
     $vec = $this->getPHID().$this->getPasswordHash().$key.$time_block;
     return substr(PhabricatorHash::digest($vec), 0, $len);
   }
 
   /**
    * Issue a new session key to this user. Phabricator supports different
    * types of sessions (like "web" and "conduit") and each session type may
    * have multiple concurrent sessions (this allows a user to be logged in on
    * multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
    * @param   string  Session type, like "web".
    * @return  string  Newly generated session key.
    */
   public function establishSession($session_type) {
     $conn_w = $this->establishConnection('w');
 
     if (strpos($session_type, '-') !== false) {
       throw new Exception("Session type must not contain hyphen ('-')!");
     }
 
     // We allow multiple sessions of the same type, so when a caller requests
     // a new session of type "web", we give them the first available session in
     // "web-1", "web-2", ..., "web-N", up to some configurable limit. If none
     // of these sessions is available, we overwrite the oldest session and
     // reissue a new one in its place.
 
     $session_limit = 1;
     switch ($session_type) {
       case 'web':
         $session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.web');
         break;
       case 'conduit':
         $session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.conduit');
         break;
       default:
         throw new Exception("Unknown session type '{$session_type}'!");
     }
 
     $session_limit = (int)$session_limit;
     if ($session_limit <= 0) {
       throw new Exception(
         "Session limit for '{$session_type}' must be at least 1!");
     }
 
     // NOTE: Session establishment is sensitive to race conditions, as when
     // piping `arc` to `arc`:
     //
     //   arc export ... | arc paste ...
     //
     // To avoid this, we overwrite an old session only if it hasn't been
     // re-established since we read it.
 
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
     // Load all the currently active sessions.
     $sessions = queryfx_all(
       $conn_w,
       'SELECT type, sessionKey, sessionStart FROM %T
         WHERE userPHID = %s AND type LIKE %>',
       PhabricatorUser::SESSION_TABLE,
       $this->getPHID(),
       $session_type.'-');
     $sessions = ipull($sessions, null, 'type');
     $sessions = isort($sessions, 'sessionStart');
 
     $existing_sessions = array_keys($sessions);
 
     // UNGUARDED WRITES: Logging-in users don't have CSRF stuff yet.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     $retries = 0;
     while (true) {
 
 
       // Choose which 'type' we'll actually establish, i.e. what number we're
       // going to append to the basic session type. To do this, just check all
       // the numbers sequentially until we find an available session.
       $establish_type = null;
       for ($ii = 1; $ii <= $session_limit; $ii++) {
         $try_type = $session_type.'-'.$ii;
         if (!in_array($try_type, $existing_sessions)) {
           $establish_type = $try_type;
           $expect_key = PhabricatorHash::digest($session_key);
           $existing_sessions[] = $try_type;
 
           // Ensure the row exists so we can issue an update below. We don't
           // care if we race here or not.
           queryfx(
             $conn_w,
             'INSERT IGNORE INTO %T (userPHID, type, sessionKey, sessionStart)
               VALUES (%s, %s, %s, 0)',
             self::SESSION_TABLE,
             $this->getPHID(),
             $establish_type,
             PhabricatorHash::digest($session_key));
           break;
         }
       }
 
       // If we didn't find an available session, choose the oldest session and
       // overwrite it.
       if (!$establish_type) {
         $oldest = reset($sessions);
         $establish_type = $oldest['type'];
         $expect_key = $oldest['sessionKey'];
       }
 
       // This is so that we'll only overwrite the session if it hasn't been
       // refreshed since we read it. If it has, the session key will be
       // different and we know we're racing other processes. Whichever one
       // won gets the session, we go back and try again.
 
       queryfx(
         $conn_w,
         'UPDATE %T SET sessionKey = %s, sessionStart = UNIX_TIMESTAMP()
           WHERE userPHID = %s AND type = %s AND sessionKey = %s',
         self::SESSION_TABLE,
         PhabricatorHash::digest($session_key),
         $this->getPHID(),
         $establish_type,
         $expect_key);
 
       if ($conn_w->getAffectedRows()) {
         // The update worked, so the session is valid.
         break;
       } else {
         // We know this just got grabbed, so don't try it again.
         unset($sessions[$establish_type]);
       }
 
       if (++$retries > $session_limit) {
         throw new Exception("Failed to establish a session!");
       }
     }
 
     $log = PhabricatorUserLog::newLog(
       $this,
       $this,
       PhabricatorUserLog::ACTION_LOGIN);
     $log->setDetails(
       array(
         'session_type' => $session_type,
         'session_issued' => $establish_type,
       ));
     $log->setSession($session_key);
     $log->save();
 
     return $session_key;
   }
 
   public function destroySession($session_key) {
     $conn_w = $this->establishConnection('w');
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userPHID = %s AND sessionKey = %s',
       self::SESSION_TABLE,
       $this->getPHID(),
       PhabricatorHash::digest($session_key));
   }
 
   private function generateEmailToken(
     PhabricatorUserEmail $email,
     $offset = 0) {
 
     $key = implode(
       '-',
       array(
         PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
         $this->getPHID(),
         $email->getVerificationCode(),
       ));
 
     return $this->generateToken(
       time() + ($offset * self::EMAIL_CYCLE_FREQUENCY),
       self::EMAIL_CYCLE_FREQUENCY,
       $key,
       self::EMAIL_TOKEN_LENGTH);
   }
 
   public function validateEmailToken(
     PhabricatorUserEmail $email,
     $token) {
     for ($ii = -1; $ii <= 1; $ii++) {
       $valid = $this->generateEmailToken($email, $ii);
       if ($token == $valid) {
         return true;
       }
     }
     return false;
   }
 
   public function getEmailLoginURI(PhabricatorUserEmail $email = null) {
     if (!$email) {
       $email = $this->loadPrimaryEmail();
       if (!$email) {
         throw new Exception("User has no primary email!");
       }
     }
     $token = $this->generateEmailToken($email);
     $uri = PhabricatorEnv::getProductionURI('/login/etoken/'.$token.'/');
     $uri = new PhutilURI($uri);
     return $uri->alter('email', $email->getAddress());
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $profile_dao->setUserPHID($this->getPHID());
       $this->profile = $profile_dao;
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception("User has no primary email address!");
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
   public function loadPreferences() {
     if ($this->preferences) {
       return $this->preferences;
     }
 
     $preferences = null;
     if ($this->getPHID()) {
       $preferences = id(new PhabricatorUserPreferences())->loadOneWhere(
         'userPHID = %s',
         $this->getPHID());
     }
 
     if (!$preferences) {
       $preferences = new PhabricatorUserPreferences();
       $preferences->setUserPHID($this->getPHID());
 
       $default_dict = array(
         PhabricatorUserPreferences::PREFERENCE_TITLES => 'glyph',
         PhabricatorUserPreferences::PREFERENCE_EDITOR => '',
         PhabricatorUserPreferences::PREFERENCE_MONOSPACED => '',
         PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE => 0);
 
       $preferences->setPreferences($default_dict);
     }
 
     $this->preferences = $preferences;
     return $preferences;
   }
 
   public function loadEditorLink($path, $line, $callsign) {
     $editor = $this->loadPreferences()->getPreference(
       PhabricatorUserPreferences::PREFERENCE_EDITOR);
 
     if (is_array($path)) {
       $multiedit = $this->loadPreferences()->getPreference(
         PhabricatorUserPreferences::PREFERENCE_MULTIEDIT);
       switch ($multiedit) {
         case '':
           $path = implode(' ', $path);
           break;
         case 'disable':
           return null;
       }
     }
 
     if ($editor) {
       return strtr($editor, array(
         '%%' => '%',
         '%f' => phutil_escape_uri($path),
         '%l' => phutil_escape_uri($line),
         '%r' => phutil_escape_uri($callsign),
       ));
     }
   }
 
   private static function tokenizeName($name) {
     if (function_exists('mb_strtolower')) {
       $name = mb_strtolower($name, 'UTF-8');
     } else {
       $name = strtolower($name);
     }
     $name = trim($name);
     if (!strlen($name)) {
       return array();
     }
     return preg_split('/\s+/', $name);
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $tokens = array_merge(
       self::tokenizeName($this->getRealName()),
       self::tokenizeName($this->getUserName()));
     $tokens = array_unique($tokens);
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $uri = $this->getEmailLoginURI();
     $body = <<<EOBODY
 Welcome to Phabricator!
 
 {$admin_username} ({$admin_realname}) has created an account for you.
 
   Username: {$user_username}
 
 To login to Phabricator, follow this link and set a password:
 
   {$uri}
 
 After you have set a password, you can login in the future by going here:
 
   {$base_uri}
 
 EOBODY;
 
     if (!$is_serious) {
       $body .= <<<EOBODY
 
 Love,
 Phabricator
 
 EOBODY;
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setSubject('[Phabricator] Welcome to Phabricator')
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorAuthProviderPassword::getPasswordProvider()) {
       $uri = $this->getEmailLoginURI();
       $password_instructions = <<<EOTXT
 If you use a password to login, you'll need to reset it before you can login
 again. You can reset your password by following this link:
 
   {$uri}
 
 And, of course, you'll need to use your new username to login from now on. If
 you use OAuth to login, nothing should change.
 
 EOTXT;
     }
 
     $body = <<<EOBODY
 {$admin_username} ({$admin_realname}) has changed your Phabricator username.
 
   Old Username: {$old_username}
   New Username: {$new_username}
 
 {$password_instructions}
 EOBODY;
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setSubject('[Phabricator] Username Changed')
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]$/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function attachStatus(PhabricatorUserStatus $status) {
     $this->status = $status;
     return $this;
   }
 
   public function getStatus() {
     $this->assertAttached($this->status);
     return $this->status;
   }
 
   public function hasStatus() {
     return $this->status !== self::ATTACHABLE;
   }
 
   public function attachProfileImageURI($uri) {
     $this->profileImage = $uri;
     return $this;
   }
 
   public function loadProfileImageURI() {
     if ($this->profileImage) {
       return $this->profileImage;
     }
 
     $src_phid = $this->getProfileImagePHID();
 
     if ($src_phid) {
       // TODO: (T603) Can we get rid of this entirely and move it to
       // PeopleQuery with attach/attachable?
       $file = id(new PhabricatorFile())->loadOneWhere('phid = %s', $src_phid);
       if ($file) {
         $this->profileImage = $file->getBestURI();
       }
     }
 
     if (!$this->profileImage) {
       $this->profileImage = self::getDefaultProfileImageURI();
     }
 
     return $this->profileImage;
   }
 
   public function getFullName() {
     return $this->getUsername().' ('.$this->getRealName().')';
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         return PhabricatorPolicies::POLICY_NOONE;
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 }
diff --git a/src/infrastructure/testing/PhabricatorTestCase.php b/src/infrastructure/testing/PhabricatorTestCase.php
index 85627c0bf..e4d586846 100644
--- a/src/infrastructure/testing/PhabricatorTestCase.php
+++ b/src/infrastructure/testing/PhabricatorTestCase.php
@@ -1,214 +1,215 @@
 <?php
 
 abstract class PhabricatorTestCase extends ArcanistPhutilTestCase {
 
   const NAMESPACE_PREFIX = 'phabricator_unittest_';
 
   /**
    * If true, put Lisk in process-isolated mode for the duration of the tests so
    * that it will establish only isolated, side-effect-free database
    * connections. Defaults to true.
    *
    * NOTE: You should disable this only in rare circumstances. Unit tests should
    * not rely on external resources like databases, and should not produce
    * side effects.
    */
   const PHABRICATOR_TESTCONFIG_ISOLATE_LISK           = 'isolate-lisk';
 
   /**
    * If true, build storage fixtures before running tests, and connect to them
    * during test execution. This will impose a performance penalty on test
    * execution (currently, it takes roughly one second to build the fixture)
    * but allows you to perform tests which require data to be read from storage
    * after writes. The fixture is shared across all test cases in this process.
    * Defaults to false.
    *
    * NOTE: All connections to fixture storage open transactions when established
    * and roll them back when tests complete. Each test must independently
    * write data it relies on; data will not persist across tests.
    *
    * NOTE: Enabling this implies disabling process isolation.
    */
   const PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES = 'storage-fixtures';
 
   private $configuration;
   private $env;
 
   private static $storageFixtureReferences = 0;
   private static $storageFixture;
   private static $storageFixtureObjectSeed = 0;
   private static $testsAreRunning = 0;
 
   protected function getPhabricatorTestCaseConfiguration() {
     return array();
   }
 
   private function getComputedConfiguration() {
     $config = $this->getPhabricatorTestCaseConfiguration() + array(
       self::PHABRICATOR_TESTCONFIG_ISOLATE_LISK             => true,
       self::PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES   => false,
     );
 
     if ($config[self::PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES]) {
       // Fixtures don't make sense with process isolation.
       $config[self::PHABRICATOR_TESTCONFIG_ISOLATE_LISK] = false;
     }
 
     return $config;
   }
 
   public function willRunTestCases(array $test_cases) {
     $root = dirname(phutil_get_library_root('phabricator'));
     require_once $root.'/scripts/__init_script__.php';
 
     $config = $this->getComputedConfiguration();
 
     if ($config[self::PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES]) {
       ++self::$storageFixtureReferences;
       if (!self::$storageFixture) {
         self::$storageFixture = $this->newStorageFixture();
       }
     }
 
     ++self::$testsAreRunning;
   }
 
   public function didRunTestCases(array $test_cases) {
     if (self::$storageFixture) {
       self::$storageFixtureReferences--;
       if (!self::$storageFixtureReferences) {
         self::$storageFixture = null;
       }
     }
 
     --self::$testsAreRunning;
   }
 
   protected function willRunTests() {
     $config = $this->getComputedConfiguration();
 
     if ($config[self::PHABRICATOR_TESTCONFIG_ISOLATE_LISK]) {
       LiskDAO::beginIsolateAllLiskEffectsToCurrentProcess();
     }
 
     $this->env = PhabricatorEnv::beginScopedEnv();
 
     // NOTE: While running unit tests, we act as though all applications are
     // installed, regardless of the install's configuration. Tests which need
     // to uninstall applications are responsible for adjusting state themselves
     // (such tests are exceedingly rare).
 
     $this->env->overrideEnvConfig(
       'phabricator.uninstalled-applications',
       array());
     $this->env->overrideEnvConfig(
       'phabricator.show-beta-applications',
       true);
 
     // Reset application settings to defaults, particularly policies.
     $this->env->overrideEnvConfig(
       'phabricator.application-settings',
       array());
 
     // TODO: Remove this when we remove "releeph.installed".
     $this->env->overrideEnvConfig('releeph.installed', true);
   }
 
   protected function didRunTests() {
     $config = $this->getComputedConfiguration();
 
     if ($config[self::PHABRICATOR_TESTCONFIG_ISOLATE_LISK]) {
       LiskDAO::endIsolateAllLiskEffectsToCurrentProcess();
     }
 
     try {
       if (phutil_is_hiphop_runtime()) {
         $this->env->__destruct();
       }
       unset($this->env);
     } catch (Exception $ex) {
       throw new Exception(
         "Some test called PhabricatorEnv::beginScopedEnv(), but is still ".
         "holding a reference to the scoped environment!");
     }
   }
 
   protected function willRunOneTest($test) {
     $config = $this->getComputedConfiguration();
 
     if ($config[self::PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES]) {
       LiskDAO::beginIsolateAllLiskEffectsToTransactions();
     }
   }
 
   protected function didRunOneTest($test) {
     $config = $this->getComputedConfiguration();
 
     if ($config[self::PHABRICATOR_TESTCONFIG_BUILD_STORAGE_FIXTURES]) {
       LiskDAO::endIsolateAllLiskEffectsToTransactions();
     }
   }
 
   protected function newStorageFixture() {
     $bytes = Filesystem::readRandomCharacters(24);
     $name = self::NAMESPACE_PREFIX.$bytes;
 
     return new PhabricatorStorageFixtureScopeGuard($name);
   }
 
   protected function getLink($method) {
     $phabricator_project = 'PHID-APRJ-3f1fc779edeab89b2171';
     return
       'https://secure.phabricator.com/diffusion/symbol/'.$method.
       '/?lang=php&projects='.$phabricator_project.
       '&jump=true&context='.get_class($this);
   }
 
   /**
    * Returns an integer seed to use when building unique identifiers (e.g.,
    * non-colliding usernames). The seed is unstable and its value will change
    * between test runs, so your tests must not rely on it.
    *
    * @return int A unique integer.
    */
   protected function getNextObjectSeed() {
     self::$storageFixtureObjectSeed += mt_rand(1, 100);
     return self::$storageFixtureObjectSeed;
   }
 
   protected function generateNewTestUser() {
     $seed = $this->getNextObjectSeed();
 
     $user = id(new PhabricatorUser())
       ->setRealName("Test User {$seed}}")
-      ->setUserName("test{$seed}");
+      ->setUserName("test{$seed}")
+      ->setIsApproved(1);
 
     $email = id(new PhabricatorUserEmail())
       ->setAddress("testuser{$seed}@example.com")
       ->setIsVerified(1);
 
     $editor = new PhabricatorUserEditor();
     $editor->setActor($user);
     $editor->createNewUser($user, $email);
 
     return $user;
   }
 
 
   /**
    * Throws unless tests are currently executing. This method can be used to
    * guard code which is specific to unit tests and should not normally be
    * reachable.
    *
    * If tests aren't currently being executed, throws an exception.
    */
   public static function assertExecutingUnitTests() {
     if (!self::$testsAreRunning) {
       throw new Exception(
         "Executing test code outside of test execution! This code path can ".
         "only be run during unit tests.");
     }
   }
 
 
 }