feat: add ALLOWED_USERS allowlist for OAuth login

feat: human validation, recursive highlighting, data mentions rename