Improve pickleader onboarding flow

[2ynn]

Pickleaders should read and agree to a confidentiality agreement before being granted access to the system

[2ynn]

related to PR #230

[2ynn]

A new Onboarding model will be created (OneToMany relationship with Person model). From the admin panel, it should be easy to enter multiple email address at once. Once an onboarding group is ready, an invitation can be sent using an admin action: this will automatically send an email to all newly registered users and provide them with a temporary password.

When they first log into the platform, onboarding pickleaders are marked as pending validation by being assigned the volunteer role. They will first be redirected to a terms&condition page that they need to sign. Agreeing to the form will update their role to pickleader, which will give them access to a Person Update form so they can update their personal information

[oxgr]

A new password_set field will be added to AuthUser to differentiate newly-onboarded users and existing pickleaders looking change password.

Index will redirect based on volunteer role with password and AuthUser.password_set value.

Some extra steps added to the pickleader onboarding flow:

1. First-time login

• with a temp password provided by email
• members only assigned a volunteer role.

2. Terms & conditions

• agrees => proceeds to next step
• disagrees => log out

3. Person update form

• hide roles, email
• keep Mixin, override has_permission() method in view for perms
• on save, add a pick_leader role and keep volunteer

4. Reset password

• a few rules of password complexity
• on save, set password_set field to True

Existing pickleaders should be able to reset their password by asking an admin (clicking revolving icon beside emails in Community view). This will set password_set to False which, on login, automatically redirects members to step (4).

TODO:

• [x] set up Onboarding model + admin forms - #230
• [x] admin action: generate temporary password + send email invite - #388
• [x] clean up permissions on views so volunteers cannot access anything besides onboarding flow - Qynn
• [x] set up public privacy policy page - #392
• [x] set up terms & condition page using generic Content model - #390
• [x] set up redirect to Person Update form - ^
• [x] set up custom Password Reset view - #391
• [x] remove "forgot password" link from main login page - ^
• [ ] create simple view to send reset_password email to selected user upon request from admin - #393