Allow the server to be configured to require passwords from all users, rather than just one.

[LeifAndersen]

This PR allows the configuration of the server to require all users to authenticate, rather than only requiring one.

I am not entirely satisfied with this PR yet, because doing this changes the protocol a little bit, namely when the client wants to submit or retrieve something, it must send the server a list of usernames and passwords. This is fine, but requires quite a few modifications to the client to work, so I want to update the client so that it can be customized to support both mutli authentication, and single auth. As well as ideally allow for arbitrary sized teams.

[samth]

Marking this as a draft since the client changes haven't happened.

[elibarzilay]

I don't know what happened that eventually lead to this idea, but I just want to say that this is a very bad idea.

At best, it will practically force students to share their passwords with their partners, which would be a problem with students getting access to their partner's handin server account (eg, seeing their exam grades, keeping access in case partner assignment changed etc). Not to mention the dangers of the still-way-too-common people who reuse passwords, and now their partner knows a password that they use elsewhere (which IMO is by itself a reason to dump this idea completely).

As bad as this might sound for an "at best" option, there are worse consequences. Assume that your students are security conscious to the point that no one shares their password, ever. What if my partner disappeared from the face of the earth for whatever reason (quite possible given that many students don't have your homework as their top priority)? The only thing I can do now is email the course staff and hope that someone is awake. And if the deadline is in two hours and I get no reply, then it practically pushes me to email the HW to the staff, and explain the problem. (And I don't know what most people would do, but at least for me it would be impossible to reply with "bad partner => tough luck", so I'll actually handle such requests.) Or what do I do if I need to fly home for the weekend for whatever reason? The only way out of this would be for one of us (P) to do some remote session with the other (Q), and let Q control P's computer for the sake of typing their password. If Q's really security-aware, then they'd refuse that since P could have a hidden keylogger. But regardless, how many people would even think about doing this? Again, most people would just give up and give away their password. Now, consider also that students tend to resubmit frequently when getting to the deadline -- each such resubmission requires this complicated dance for entering both passwords.

The bottom line is that not sharing passwords requires all partners to work together (usually physically together). Do you like to work until midnight? Too bad, your partner crashes at 8pm, so you can't do anything(). Are you an early riser? Too bad, your partner wakes up at 11 and runs to classes which are not over until 6pm. A team of 3 students becomes a scheduling nightmare. Now, note the earlier "()" -- of course you can continue working on your own copy of the homework until you meet your partner tomorrow. But then what if your partner wants to work on another part? You now need to remember who has which copy -- is your copy newer than mine or not? Maybe we both worked on different parts, so now we need to remember who did what to merge the two copies before the submission. Oh, and yes, when we did it, I forgot that I fixed that one line in your part, and when we merged it, I forgot about it, and now we got 20 points off for that so of course I need to send the course staff this whole story. And even if we didn't think about it initially, after 2 such homework we'd be practically pushed to finding some creative solution like github, or worse, some code snip site to be able to share our work. And now the course staff has an additional problem: hunting publicly available homework solutions and taking them down. (I explicitly tell students to not do that, and still people forget, and these code snippet sites make deleting shares practically impossible.)

Oh, and in case it wasn't clear: I avoided talking about the problem of requiring all passwords when retrieving homework, since that just tends to make all of the above worse. Students tend to use the handin server as a place to store their shared work, requiring both passwords to retrieve the file means that this is completely destroyed: trying to use it requires both students to work physically together which further pushes people away to external tools for shared work. Oh, and if I remembered that I did that one mistake in my code and I now, two hours before the deadline, realized that there's a horrible bug in it, again, I have no way to fix it unless I have a copy of the file, other than a panicky email to the staff. On top of all of that, I'm not allowed to get a copy of my own submitted homework, but later on I'll be able to see how it was graded by myself?? That makes no sense.