Users can currently authorize an application and view the applications they've authorized, but can not revoke access. We should add support for this.

A few places in GMGTableBase have method definitions that look something like:

    def find_one(cls, query_dict={}):
       ...

This is almost certainly not what the authors intended. The default argument list is only evaluated once during execution, at import time. The code above creates a single dictionary as the default, and if this is mutated down the line, the mutated value becomes the default for subsequent calls. In these particular cases it's unlikely to cause problems -- that argument will almost certainly be passed in -- but in the event it's not, this can cause very strange, difficult to diagnose behavior. The correct approach is to use an immutable value as an argument default.

Note that this same problem exists for class level attributes: defining a class such as:

    class Foo(object):

        bar = {}

means that for *every* instance of Foo, self.bar will point to the *same* dict.

Whenever bin/gmg adduser is used, a minor error is raised because the code filters the User table for a unicode string using a non-unicode string. This is the error that is raised:

mediagoblin/local/lib/python2.7/site-packages/SQLAlchemy-0.8.2-py2.7-linux-i686.egg/sqlalchemy/engine/default.py:459: SAWarning: Unicode type received non-unicode bind param value.
  param.append(processors[key](compiled_params[key]))

This doesn't affect functionality at all, but may be confusing if unfixed.