Fixes #1747.

1. Fix auth bypass in the default configuration with the addition of
   server.password (the REGISTER command was allowed before connection
   registration, allowing unauthenticated users to REGISTER and then
   take advantage of skip-server-password)
2. Caution operators against the use of require-sasl without disabling
   user-initiated account registration. (Such a configuration is still valid
   in the case of a public server that requires everyone to register.)

AWAY status should be tracked per-session:

1. With auto-away enabled, away status is aggregated across sessions
   (if any session is not away, the client is not away, else use
   the away status that was set most recently)
2. With auto-away disabled, we get the legacy behavior where AWAY
   applies directly to the client

The +M channel mode is documented twice. Merge the two sections.
Clarify that +R restricts both joining and speaking, but does not kick existing unregistered users.

Resolves: #1578

Let halfops change the channel topic

strip local_ from oper capab names, also consolidate unban into ban

See #1488

Add chanmode preventing speech to error message.

Fixes #1182.