diff --git a/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php b/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
index 4d04707598..0962b7b56a 100644
--- a/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
+++ b/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
@@ -1,258 +1,256 @@
 <?php
 
 final class PhabricatorAuthSSHKeyEditor
   extends PhabricatorApplicationTransactionEditor {
 
   public function getEditorApplicationClass() {
     return 'PhabricatorAuthApplication';
   }
 
   public function getEditorObjectsDescription() {
     return pht('SSH Keys');
   }
 
   public function getTransactionTypes() {
     $types = parent::getTransactionTypes();
 
     $types[] = PhabricatorAuthSSHKeyTransaction::TYPE_NAME;
     $types[] = PhabricatorAuthSSHKeyTransaction::TYPE_KEY;
     $types[] = PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE;
 
     return $types;
   }
 
   protected function getCustomTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
         return $object->getName();
       case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
         return $object->getEntireKey();
       case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
         return !$object->getIsActive();
     }
 
   }
 
   protected function getCustomTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
       case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
         return $xaction->getNewValue();
       case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
         return (bool)$xaction->getNewValue();
     }
   }
 
   protected function applyCustomInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $value = $xaction->getNewValue();
     switch ($xaction->getTransactionType()) {
       case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
         $object->setName($value);
         return;
       case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
         $public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($value);
 
         $type = $public_key->getType();
         $body = $public_key->getBody();
         $comment = $public_key->getComment();
 
         $object->setKeyType($type);
         $object->setKeyBody($body);
         $object->setKeyComment($comment);
         return;
       case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
         if ($value) {
           $new = null;
         } else {
           $new = 1;
         }
 
         $object->setIsActive($new);
         return;
     }
   }
 
   protected function applyCustomExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return;
   }
 
   protected function validateTransaction(
     PhabricatorLiskDAO $object,
     $type,
     array $xactions) {
 
     $errors = parent::validateTransaction($object, $type, $xactions);
 
     switch ($type) {
       case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
         $missing = $this->validateIsEmptyTextField(
           $object->getName(),
           $xactions);
 
         if ($missing) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Required'),
             pht('SSH key name is required.'),
             nonempty(last($xactions), null));
 
           $error->setIsMissingFieldError(true);
           $errors[] = $error;
         }
         break;
 
       case PhabricatorAuthSSHKeyTransaction::TYPE_KEY;
         $missing = $this->validateIsEmptyTextField(
           $object->getName(),
           $xactions);
 
         if ($missing) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Required'),
             pht('SSH key material is required.'),
             nonempty(last($xactions), null));
 
           $error->setIsMissingFieldError(true);
           $errors[] = $error;
         } else {
           foreach ($xactions as $xaction) {
             $new = $xaction->getNewValue();
 
             try {
               $public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($new);
             } catch (Exception $ex) {
               $errors[] = new PhabricatorApplicationTransactionValidationError(
                 $type,
                 pht('Invalid'),
                 $ex->getMessage(),
                 $xaction);
             }
           }
         }
         break;
 
       case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
         foreach ($xactions as $xaction) {
           if (!$xaction->getNewValue()) {
             $errors[] = new PhabricatorApplicationTransactionValidationError(
               $type,
               pht('Invalid'),
               pht('SSH keys can not be reactivated.'),
               $xaction);
           }
         }
         break;
     }
 
     return $errors;
   }
 
   protected function didCatchDuplicateKeyException(
     PhabricatorLiskDAO $object,
     array $xactions,
     Exception $ex) {
 
     $errors = array();
     $errors[] = new PhabricatorApplicationTransactionValidationError(
       PhabricatorAuthSSHKeyTransaction::TYPE_KEY,
       pht('Duplicate'),
       pht(
         'This public key is already associated with another user or device. '.
         'Each key must unambiguously identify a single unique owner.'),
       null);
 
     throw new PhabricatorApplicationTransactionValidationException($errors);
   }
 
 
   protected function shouldSendMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return true;
   }
 
   protected function getMailSubjectPrefix() {
     return pht('[SSH Key]');
   }
 
   protected function getMailThreadID(PhabricatorLiskDAO $object) {
     return 'ssh-key-'.$object->getPHID();
   }
 
   protected function applyFinalEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     // After making any change to an SSH key, drop the authfile cache so it
     // is regenerated the next time anyone authenticates.
-    $cache = PhabricatorCaches::getMutableCache();
-    $authfile_key = PhabricatorAuthSSHKeyQuery::AUTHFILE_CACHEKEY;
-    $cache->deleteKey($authfile_key);
+    PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();
 
     return $xactions;
   }
 
 
   protected function getMailTo(PhabricatorLiskDAO $object) {
     return $object->getObject()->getSSHKeyNotifyPHIDs();
   }
 
   protected function getMailCC(PhabricatorLiskDAO $object) {
     return array();
   }
 
   protected function buildReplyHandler(PhabricatorLiskDAO $object) {
     return id(new PhabricatorAuthSSHKeyReplyHandler())
       ->setMailReceiver($object);
   }
 
   protected function buildMailTemplate(PhabricatorLiskDAO $object) {
     $id = $object->getID();
     $name = $object->getName();
     $phid = $object->getPHID();
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->setSubject(pht('SSH Key %d: %s', $id, $name))
       ->addHeader('Thread-Topic', $phid);
 
     // The primary value of this mail is alerting users to account compromises,
     // so force delivery. In particular, this mail should still be delievered
     // even if "self mail" is disabled.
     $mail->setForceDelivery(true);
 
     return $mail;
   }
 
   protected function buildMailBody(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $body = parent::buildMailBody($object, $xactions);
 
     $body->addTextSection(
       pht('SECURITY WARNING'),
       pht(
         'If you do not recognize this change, it may indicate your account '.
         'has been compromised.'));
 
     $detail_uri = $object->getURI();
     $detail_uri = PhabricatorEnv::getProductionURI($detail_uri);
 
     $body->addLinkSection(pht('SSH KEY DETAIL'), $detail_uri);
 
     return $body;
   }
 
 }
diff --git a/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php b/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
index 6ba047d100..77b666ea44 100644
--- a/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
+++ b/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
@@ -1,132 +1,138 @@
 <?php
 
 final class PhabricatorAuthSSHKeyQuery
   extends PhabricatorCursorPagedPolicyAwareQuery {
 
   const AUTHFILE_CACHEKEY = 'ssh.authfile';
 
   private $ids;
   private $phids;
   private $objectPHIDs;
   private $keys;
   private $isActive;
 
+  public static function deleteSSHKeyCache() {
+    $cache = PhabricatorCaches::getMutableCache();
+    $authfile_key = self::AUTHFILE_CACHEKEY;
+    $cache->deleteKey($authfile_key);
+  }
+
   public function withIDs(array $ids) {
     $this->ids = $ids;
     return $this;
   }
 
   public function withPHIDs(array $phids) {
     $this->phids = $phids;
     return $this;
   }
 
   public function withObjectPHIDs(array $object_phids) {
     $this->objectPHIDs = $object_phids;
     return $this;
   }
 
   public function withKeys(array $keys) {
     assert_instances_of($keys, 'PhabricatorAuthSSHPublicKey');
     $this->keys = $keys;
     return $this;
   }
 
   public function withIsActive($active) {
     $this->isActive = $active;
     return $this;
   }
 
   public function newResultObject() {
     return new PhabricatorAuthSSHKey();
   }
 
   protected function loadPage() {
     return $this->loadStandardPage($this->newResultObject());
   }
 
   protected function willFilterPage(array $keys) {
     $object_phids = mpull($keys, 'getObjectPHID');
 
     $objects = id(new PhabricatorObjectQuery())
       ->setViewer($this->getViewer())
       ->setParentQuery($this)
       ->withPHIDs($object_phids)
       ->execute();
     $objects = mpull($objects, null, 'getPHID');
 
     foreach ($keys as $key => $ssh_key) {
       $object = idx($objects, $ssh_key->getObjectPHID());
 
       // We must have an object, and that object must be a valid object for
       // SSH keys.
       if (!$object || !($object instanceof PhabricatorSSHPublicKeyInterface)) {
         $this->didRejectResult($ssh_key);
         unset($keys[$key]);
         continue;
       }
 
       $ssh_key->attachObject($object);
     }
 
     return $keys;
   }
 
   protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
     $where = parent::buildWhereClauseParts($conn);
 
     if ($this->ids !== null) {
       $where[] = qsprintf(
         $conn,
         'id IN (%Ld)',
         $this->ids);
     }
 
     if ($this->phids !== null) {
       $where[] = qsprintf(
         $conn,
         'phid IN (%Ls)',
         $this->phids);
     }
 
     if ($this->objectPHIDs !== null) {
       $where[] = qsprintf(
         $conn,
         'objectPHID IN (%Ls)',
         $this->objectPHIDs);
     }
 
     if ($this->keys !== null) {
       $sql = array();
       foreach ($this->keys as $key) {
         $sql[] = qsprintf(
           $conn,
           '(keyType = %s AND keyIndex = %s)',
           $key->getType(),
           $key->getHash());
       }
       $where[] = implode(' OR ', $sql);
     }
 
     if ($this->isActive !== null) {
       if ($this->isActive) {
         $where[] = qsprintf(
           $conn,
           'isActive = %d',
           1);
       } else {
         $where[] = qsprintf(
           $conn,
           'isActive IS NULL');
       }
     }
 
     return $where;
 
   }
 
   public function getQueryApplicationClass() {
     return 'PhabricatorAuthApplication';
   }
 
 }
diff --git a/src/applications/people/editor/PhabricatorUserEditor.php b/src/applications/people/editor/PhabricatorUserEditor.php
index 3370fb428b..cb5ed65f8d 100644
--- a/src/applications/people/editor/PhabricatorUserEditor.php
+++ b/src/applications/people/editor/PhabricatorUserEditor.php
@@ -1,734 +1,738 @@
 <?php
 
 /**
  * Editor class for creating and adjusting users. This class guarantees data
  * integrity and writes logs when user information changes.
  *
  * @task config     Configuration
  * @task edit       Creating and Editing Users
  * @task role       Editing Roles
  * @task email      Adding, Removing and Changing Email
  * @task internal   Internals
  */
 final class PhabricatorUserEditor extends PhabricatorEditor {
 
   private $logs = array();
 
 
 /* -(  Creating and Editing Users  )----------------------------------------- */
 
 
   /**
    * @task edit
    */
   public function createNewUser(
     PhabricatorUser $user,
     PhabricatorUserEmail $email,
     $allow_reassign = false) {
 
     if ($user->getID()) {
       throw new Exception(pht('User has already been created!'));
     }
 
     $is_reassign = false;
     if ($email->getID()) {
       if ($allow_reassign) {
         if ($email->getIsPrimary()) {
           throw new Exception(
             pht('Primary email addresses can not be reassigned.'));
         }
         $is_reassign = true;
       } else {
         throw new Exception(pht('Email has already been created!'));
       }
     }
 
     if (!PhabricatorUser::validateUsername($user->getUsername())) {
       $valid = PhabricatorUser::describeValidUsername();
       throw new Exception(pht('Username is invalid! %s', $valid));
     }
 
     // Always set a new user's email address to primary.
     $email->setIsPrimary(1);
 
     // If the primary address is already verified, also set the verified flag
     // on the user themselves.
     if ($email->getIsVerified()) {
       $user->setIsEmailVerified(1);
     }
 
     $this->willAddEmail($email);
 
     $user->openTransaction();
       try {
         $user->save();
         $email->setUserPHID($user->getPHID());
         $email->save();
       } catch (AphrontDuplicateKeyQueryException $ex) {
         // We might have written the user but failed to write the email; if
         // so, erase the IDs we attached.
         $user->setID(null);
         $user->setPHID(null);
 
         $user->killTransaction();
         throw $ex;
       }
 
       $log = PhabricatorUserLog::initializeNewLog(
         $this->requireActor(),
         $user->getPHID(),
         PhabricatorUserLog::ACTION_CREATE);
       $log->setNewValue($email->getAddress());
       $log->save();
 
       if ($is_reassign) {
         $log = PhabricatorUserLog::initializeNewLog(
           $this->requireActor(),
           $user->getPHID(),
           PhabricatorUserLog::ACTION_EMAIL_REASSIGN);
         $log->setNewValue($email->getAddress());
         $log->save();
       }
 
     $user->saveTransaction();
 
     if ($email->getIsVerified()) {
       $this->didVerifyEmail($user, $email);
     }
 
     return $this;
   }
 
 
   /**
    * @task edit
    */
   public function updateUser(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null) {
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->save();
       if ($email) {
         $email->save();
       }
 
       $log = PhabricatorUserLog::initializeNewLog(
         $this->requireActor(),
         $user->getPHID(),
         PhabricatorUserLog::ACTION_EDIT);
       $log->save();
 
     $user->saveTransaction();
 
     return $this;
   }
 
 
   /**
    * @task edit
    */
   public function changePassword(
     PhabricatorUser $user,
     PhutilOpaqueEnvelope $envelope) {
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->reload();
 
       $user->setPassword($envelope);
       $user->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         $this->requireActor(),
         $user->getPHID(),
         PhabricatorUserLog::ACTION_CHANGE_PASSWORD);
       $log->save();
 
     $user->saveTransaction();
   }
 
 
   /**
    * @task edit
    */
   public function changeUsername(PhabricatorUser $user, $username) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     if (!PhabricatorUser::validateUsername($username)) {
       $valid = PhabricatorUser::describeValidUsername();
       throw new Exception(pht('Username is invalid! %s', $valid));
     }
 
     $old_username = $user->getUsername();
 
     $user->openTransaction();
       $user->reload();
       $user->setUsername($username);
 
       try {
         $user->save();
       } catch (AphrontDuplicateKeyQueryException $ex) {
         $user->setUsername($old_username);
         $user->killTransaction();
         throw $ex;
       }
 
       $log = PhabricatorUserLog::initializeNewLog(
         $actor,
         $user->getPHID(),
         PhabricatorUserLog::ACTION_CHANGE_USERNAME);
       $log->setOldValue($old_username);
       $log->setNewValue($username);
       $log->save();
 
     $user->saveTransaction();
 
+    // The SSH key cache currently includes usernames, so dirty it. See T12554
+    // for discussion.
+    PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();
+
     $user->sendUsernameChangeEmail($actor, $old_username);
   }
 
 
 /* -(  Editing Roles  )------------------------------------------------------ */
 
 
   /**
    * @task role
    */
   public function makeAdminUser(PhabricatorUser $user, $admin) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         if ($user->getIsAdmin() == $admin) {
           $user->endWriteLocking();
           $user->killTransaction();
           return $this;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_ADMIN);
         $log->setOldValue($user->getIsAdmin());
         $log->setNewValue($admin);
 
         $user->setIsAdmin((int)$admin);
         $user->save();
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
   /**
    * @task role
    */
   public function makeSystemAgentUser(PhabricatorUser $user, $system_agent) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         if ($user->getIsSystemAgent() == $system_agent) {
           $user->endWriteLocking();
           $user->killTransaction();
           return $this;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_SYSTEM_AGENT);
         $log->setOldValue($user->getIsSystemAgent());
         $log->setNewValue($system_agent);
 
         $user->setIsSystemAgent((int)$system_agent);
         $user->save();
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
   /**
    * @task role
    */
   public function makeMailingListUser(PhabricatorUser $user, $mailing_list) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         if ($user->getIsMailingList() == $mailing_list) {
           $user->endWriteLocking();
           $user->killTransaction();
           return $this;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_MAILING_LIST);
         $log->setOldValue($user->getIsMailingList());
         $log->setNewValue($mailing_list);
 
         $user->setIsMailingList((int)$mailing_list);
         $user->save();
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
   /**
    * @task role
    */
   public function disableUser(PhabricatorUser $user, $disable) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         if ($user->getIsDisabled() == $disable) {
           $user->endWriteLocking();
           $user->killTransaction();
           return $this;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_DISABLE);
         $log->setOldValue($user->getIsDisabled());
         $log->setNewValue($disable);
 
         $user->setIsDisabled((int)$disable);
         $user->save();
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
 
   /**
    * @task role
    */
   public function approveUser(PhabricatorUser $user, $approve) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         if ($user->getIsApproved() == $approve) {
           $user->endWriteLocking();
           $user->killTransaction();
           return $this;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_APPROVE);
         $log->setOldValue($user->getIsApproved());
         $log->setNewValue($approve);
 
         $user->setIsApproved($approve);
         $user->save();
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
 
 /* -(  Adding, Removing and Changing Email  )-------------------------------- */
 
 
   /**
    * @task email
    */
   public function addEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
 
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
     if ($email->getID()) {
       throw new Exception(pht('Email has already been created!'));
     }
 
     // Use changePrimaryEmail() to change primary email.
     $email->setIsPrimary(0);
     $email->setUserPHID($user->getPHID());
 
     $this->willAddEmail($email);
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
 
         try {
           $email->save();
         } catch (AphrontDuplicateKeyQueryException $ex) {
           $user->endWriteLocking();
           $user->killTransaction();
 
           throw $ex;
         }
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_EMAIL_ADD);
         $log->setNewValue($email->getAddress());
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     return $this;
   }
 
 
   /**
    * @task email
    */
   public function removeEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
 
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
     if (!$email->getID()) {
       throw new Exception(pht('Email has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         $email->reload();
 
         if ($email->getIsPrimary()) {
           throw new Exception(pht("Can't remove primary email!"));
         }
         if ($email->getUserPHID() != $user->getPHID()) {
           throw new Exception(pht('Email not owned by user!'));
         }
 
         $email->delete();
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_EMAIL_REMOVE);
         $log->setOldValue($email->getAddress());
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     $this->revokePasswordResetLinks($user);
 
     return $this;
   }
 
 
   /**
    * @task email
    */
   public function changePrimaryEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
     if (!$email->getID()) {
       throw new Exception(pht('Email has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         $email->reload();
 
         if ($email->getUserPHID() != $user->getPHID()) {
           throw new Exception(pht('User does not own email!'));
         }
 
         if ($email->getIsPrimary()) {
           throw new Exception(pht('Email is already primary!'));
         }
 
         if (!$email->getIsVerified()) {
           throw new Exception(pht('Email is not verified!'));
         }
 
         $old_primary = $user->loadPrimaryEmail();
         if ($old_primary) {
           $old_primary->setIsPrimary(0);
           $old_primary->save();
         }
 
         $email->setIsPrimary(1);
         $email->save();
 
         $log = PhabricatorUserLog::initializeNewLog(
           $actor,
           $user->getPHID(),
           PhabricatorUserLog::ACTION_EMAIL_PRIMARY);
         $log->setOldValue($old_primary ? $old_primary->getAddress() : null);
         $log->setNewValue($email->getAddress());
 
         $log->save();
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     if ($old_primary) {
       $old_primary->sendOldPrimaryEmail($user, $email);
     }
     $email->sendNewPrimaryEmail($user);
 
 
     $this->revokePasswordResetLinks($user);
 
     return $this;
   }
 
 
   /**
    * Verify a user's email address.
    *
    * This verifies an individual email address. If the address is the user's
    * primary address and their account was not previously verified, their
    * account is marked as email verified.
    *
    * @task email
    */
   public function verifyEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
     if (!$email->getID()) {
       throw new Exception(pht('Email has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         $email->reload();
 
         if ($email->getUserPHID() != $user->getPHID()) {
           throw new Exception(pht('User does not own email!'));
         }
 
         if (!$email->getIsVerified()) {
           $email->setIsVerified(1);
           $email->save();
 
           $log = PhabricatorUserLog::initializeNewLog(
             $actor,
             $user->getPHID(),
             PhabricatorUserLog::ACTION_EMAIL_VERIFY);
           $log->setNewValue($email->getAddress());
           $log->save();
         }
 
         if (!$user->getIsEmailVerified()) {
           // If the user just verified their primary email address, mark their
           // account as email verified.
           $user_primary = $user->loadPrimaryEmail();
           if ($user_primary->getID() == $email->getID()) {
             $user->setIsEmailVerified(1);
             $user->save();
           }
         }
 
       $user->endWriteLocking();
     $user->saveTransaction();
 
     $this->didVerifyEmail($user, $email);
   }
 
 
   /**
    * Reassign an unverified email address.
    */
   public function reassignEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
     $actor = $this->requireActor();
 
     if (!$user->getID()) {
       throw new Exception(pht('User has not been created yet!'));
     }
 
     if (!$email->getID()) {
       throw new Exception(pht('Email has not been created yet!'));
     }
 
     $user->openTransaction();
       $user->beginWriteLocking();
 
         $user->reload();
         $email->reload();
 
         $old_user = $email->getUserPHID();
 
         if ($old_user != $user->getPHID()) {
           if ($email->getIsVerified()) {
             throw new Exception(
               pht('Verified email addresses can not be reassigned.'));
           }
           if ($email->getIsPrimary()) {
             throw new Exception(
               pht('Primary email addresses can not be reassigned.'));
           }
 
           $email->setUserPHID($user->getPHID());
           $email->save();
 
           $log = PhabricatorUserLog::initializeNewLog(
             $actor,
             $user->getPHID(),
             PhabricatorUserLog::ACTION_EMAIL_REASSIGN);
           $log->setNewValue($email->getAddress());
           $log->save();
         }
 
       $user->endWriteLocking();
     $user->saveTransaction();
   }
 
 
 /* -(  Internals  )---------------------------------------------------------- */
 
 
   /**
    * @task internal
    */
   private function willAddEmail(PhabricatorUserEmail $email) {
 
     // Hard check before write to prevent creation of disallowed email
     // addresses. Normally, the application does checks and raises more
     // user friendly errors for us, but we omit the courtesy checks on some
     // pathways like administrative scripts for simplicity.
 
     if (!PhabricatorUserEmail::isValidAddress($email->getAddress())) {
       throw new Exception(PhabricatorUserEmail::describeValidAddresses());
     }
 
     if (!PhabricatorUserEmail::isAllowedAddress($email->getAddress())) {
       throw new Exception(PhabricatorUserEmail::describeAllowedAddresses());
     }
 
     $application_email = id(new PhabricatorMetaMTAApplicationEmailQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withAddresses(array($email->getAddress()))
       ->executeOne();
     if ($application_email) {
       throw new Exception($application_email->getInUseMessage());
     }
   }
 
   public function revokePasswordResetLinks(PhabricatorUser $user) {
     // Revoke any outstanding password reset links. If an attacker compromises
     // an account, changes the email address, and sends themselves a password
     // reset link, it could otherwise remain live for a short period of time
     // and allow them to compromise the account again later.
 
     PhabricatorAuthTemporaryToken::revokeTokens(
       $user,
       array($user->getPHID()),
       array(
         PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE,
         PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE,
       ));
   }
 
   private function didVerifyEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $email) {
 
     $event_type = PhabricatorEventType::TYPE_AUTH_DIDVERIFYEMAIL;
     $event_data = array(
       'user' => $user,
       'email' => $email,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
   }
 
 
 }