I have stopped using AJAX uploaders for images (and other files) everywhere on the site. I was using the one from MS‘s AjaxControlToolkit on about 4 pages, and there were always some problems with it. Now my patience has run out, and I have replaced all of it with <input type="file" multiple="multiple" />.
This point is related to point 1 – I now have a universal class not only for displaying a photo gallery, but also for uploading. All you need to do now is create an instance of this class and pass it a collection of HttpPostedFiles – the class takes care of everything else on its own.
The user profile page, for example 👻 The page moved out and left no forwarding address.now displays an image it downloads from gravatar.com. It is not in a very high resolution, only 80x80px, but at least it is something.
Gravatars are no longer downloaded on every page load. Now you change your avatar on gravatar.com and a button loads it onto my hosting. This speeds up loading of all pages and reduces the load on the servers of gravatar.com.
Now, when you log in while you are also logged in elsewhere, the secret code does not change. The same applies to logging out: if you are logged in in several places and log out in one of them, you invalidate your login on all the other sites. I also had problems here when I changed my email and it did not work.
In the end, though, it started working, and all I did was stop checking whether the row exists in the table and fetch the email instead. Next I would like to make it so that when someone makes, say, 10 failed login attempts within an hour, the system blocks them and they will only get another 10 attempts an hour later.
This should apply everywhere the user tries to perform any authorized operations, including the ashx handlers, of which I have countless.