Add traps; user registration

TODO.text

@@ -1,7 +1,6 @@
 - App setup wizard
 - SAML IAM handling
 - LDAP IAM handling
-- User registration
 - Cobalt form JSON field type - Setting resource
 - MFA recovery codes handling
 - Forgot password handling
@@ -14,3 +13,6 @@
 - IAM manage user API scopes
 - Eliminate LDAP group model, make LDAP server use standard auth group
 - OAuth2 -> support refresh tokens
+- Traps -> support session traps; convert MFA challenge to use session trap
+    - Allow setting user trap from web UI
+    - Don't allow external logins if trap is set