email address not validated when the user changes it
When a user updates his email address, django does not send a confirmation email to ensure that the user effectively controls this address.
This allows any user to forge a inria/irisa address to create a webapp.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information