This is necessary in case the exporter wants to redirect output to a file.
Use built-in PHP functions to encode and output CSV content

Sanitize textarea content on export

This is necessary to allow for other form types to use dynamic data
view/export

It is possible that a recipient received and processed by the system may not
have a name set. In that case, the email mailbox should be used. As a
failsafe, avoid crashing if the User::save() should fail.

This occurs for attachments added via the staff or client web interfaces

Use .domain.tld to accept all subdomains of a parent

This is a slight edit over the previous implementation of the same feature.
Previously, an "account" was required, which implies a user account with a
password. This implementation simply requires a user record. Importing of
users by organization domain is still supported -- even if the user does not
yet exist.

  * Auto confirm remote accounts
  * Don't send out emails for remote account activation
  * Forbid password changes on remote accounts

This stems from a confusing similarity between the + operator for arrays
and array_merge() in php. Adding arrays will ignore items in the RHS where
keys are present in the LHS. Therefore, when adding numerically indexed
arrays together, only items on the RHS that have a key higher than the
greatest key on the LHS will be included.