This occurs for attachments added via the staff or client web interfaces

Use .domain.tld to accept all subdomains of a parent

This is a slight edit over the previous implementation of the same feature.
Previously, an "account" was required, which implies a user account with a
password. This implementation simply requires a user record. Importing of
users by organization domain is still supported -- even if the user does not
yet exist.

  * Auto confirm remote accounts
  * Don't send out emails for remote account activation
  * Forbid password changes on remote accounts

This stems from a confusing similarity between the + operator for arrays
and array_merge() in php. Adding arrays will ignore items in the RHS where
keys are present in the LHS. Therefore, when adding numerically indexed
arrays together, only items on the RHS that have a key higher than the
greatest key on the LHS will be included.

Support adding remote user to an organization