Document that authenticated users can send email as others

[albertito]

Authenticated users are intentionally allowed to send email as other users or domains.

This is a design choice made to balance simplicity of operation and use. However, it can be surprising, and it should be documented much more clearly.

Users who want to be strict about "MAIL FROM" or even "From:" validation can add additional checks in the post-DATA hook.

In the future, chasquid may get some option to be strict about it by default, or on a per-domain or per-user basis. But for now, using a post-DATA hook is the best way to make chasquid more strict about this. I'll try to include some examples for this in the documentation too.

Thanks to Matěj Volf for reporting this issue!

[mvolfik]

btw, here's a patch that I deployed to my own server that implements this check in chasquid itself. It's patched in the obvious place with least possible effort while staying compatible with old users config file, not sure if there's any interest in merging this, but I just wanted to offer it: main...mvolfik:chasquid:main

(there's also a patch of the sender address of delivery status notifications - I'm forwarding my received emails to gmail, and it refused to accept the <> from address)