E-mail messages send by request from the Web (e.g. e-mail address verification e-mail, password recovery e-mail) should include the IP address of the requester.

That will help the receiver decide if the message is legitimate.

A minor privacy issue might exist (message with the IP address going through mail servers).

It is convenient for the user to know how big of a file they can upload before they try.

The changes in Issue #582 introduced some interesting code:

def user_may_delete_media(controller):
...
        uploader = request.db.MediaEntry.find_one(
            {'slug': request.matchdict['media']}).get_uploader()

If two people have the same slug, this query will not always do the right thing(TM).

That said, I'd really prefer things like "edit" and "delete" use the id instead of the slug. It just feels safer and will avoid all these slug duplicates/etc issuess. I don't see anyone needing to bookmark the delete page? And bookmarking the edit page might have rare use cases, so those should be able to live with ugly urls.

For performance/safety reasons, we could consider to have an extra decorator for finding the media only by user/id or somesuch.