On any media page, the text says "Upload on X by X" and then shows an "Edit" link.

This link shows up for anyone, but it should only be visible if you're the owner of that piece of media and are logged in (and thus are the only one that can actually edit it).

We should think about what we want to show in the top right of our pages.

Currently, when a user is logged in, we've got: [user]'s account home gallery (logout)

This is getting crowded! :)

I propose we do this:

• Use [user] as the "home" link, which links to the user's profile page.
• Remove the "gallery" link. If the user wants to see his or her own gallery, that can be done by going to the profile page, then clicking "all images" or something similar. This leaves:
• The "logout" link. At first I also wanted to move this to the profile page, but cwebber pointed out it might be better to keep in the top right. While it may not be an action that is frequently used, it can be of high importance for security. Also, the placing right next to "[user]'s account" makes a lot of sense, I think.
• An "upload" button/link. We don't have this yet, but the top right might be a good idea. Similar to for instance YouTube, who have a big bright yellow upload button always at the top. It makes sense, because submitting media is presumably what Mediagoblin is used for. :)

Other websites, like for instance Wordpress or Gmail, have a dropdown menu, where you can view info or logout. It's one way to do it, but personally I'm not a big fan. It's hard to make clear graphically that it's a dropdown menu instead of a regular link, they don't always work well on mobile devices and it makes the code more complex.

Currently we have status being one of "active" or 'needs_email_verification'... we could simplify things by just having email_verified (which we already have) and "active" be a boolean.

The role of active will then switch to whether or not the user is enabled. You might set active to False if a user was abusing their account, for instance.

The migration on this should be pretty easy... just remove needs_email_verification and make all existing users active, since currently we don't have any inactive state.

This is a bitesized task.