ULTRA_SEC ("paranoid") userData option mode

[7-of-9]

Requires MPK to be entered on each usage (i.e. on each assetRaw decrypt) -- no persist of h_mpk in localStorage, or as window global var.

[7-of-9]

There should be a user option to activate a security one level higher than High Security: UltraSec.

If UltraSec=1 then document.hjs_mpk should not be persisted in any JS context. The user should be prompted for his MPK each time its hash is required and its value held in memory and nuked after use.

Note this is partially implemented / WIP re. <LoginForm... unlockMode=true>.