Make sure email login is enforced at DDP level + tests about todos

[splendido]

useraccounts uses a server-side method to register new users both to enforce additional fields validation (which could be easily avoided on the client-side...), add some additional hook and provide support for ReCaptcha (still not fully tested). To do so, use of Accounts.createUser from the client side id prohibited by setting forbidClientAccountCreation to true: see here
Here is where the call to ATCreateUserServer is triggered.

As for password login operations, regular Meteor.loginWithPassword is used here.
Also for OAuth logins there's nothing special. See here the selection of the method to call based on the name of the selected service.

The only other thing enforced on the server-side is the email verification which takes place thanks to this validateLoginAttempt callback in case configuration options where set appropriately.

[stubailo]

Seems like it already does everything by default, then!

Awesome.