Right, those are all of them. And they only need to return the 404 status, not any other data.

Another thing to note: suspended users shouldn't show up in the Reader view.

Perfect 👍

This is important for people with different workflows, so this is the next highest priority after T571: Import posts from WordPress and {T646}.

I've already started on this on Write.as Web, so I'll finish this up.

Limiting customizations like this also helps people set up more simplified instances, e.g. T681: Reader-page-centric multi-user instances.

More user discussion here.

I agree about not wanting to have passwords in command line users' history, but I think supporting an optional password flag would be the simplest route. I'm thinking of the mysql client as an example, where you can supply -p without anything else and it'll interactively prompt for a password, or accept a password along with the flag if you want.