TODO

• Block all entry points except /auth/service/:service/finish when in pending state
  • instead of blocking, just ignore the token on all other endpoints—add a field to /now and /auth that shows the pending state. (just add the user key to /now basically). clients can then show the pending screen on load.
• remove suggestedName (we shouldn't ask for the username from a third party service at all)
• add available avatars list to postMessage