Putting text in the description field is just text. It doesn't automatically parse text as links, you have to specify with Markdown, it's a lesser known formatting language compared to BBCode. The format for a URL is square brackets for the clickable text and curly braces for the actual link. [Visit Google](http://www.google.com)
TOTP is a very simple process to code, there are lots of project libraries for all sorts of languages that are easy to import, and if you want to roll your own at least just by reviewing the specs and those libraries, it's still not that many lines of code. On login, you just check if the account has it enabled, if not, you continue as you already do, if it is, you forward to the code entry page.
The same TOTP codes can be either generated in an app (Google Auth, or on a pc WinAuth), or a small text link of 'use alternative' and get it by email or sms (probably easy to just use major cellular providers email-sms gateways). A lot of the TFA sites (like google itself) have a list of backup codes that are longer that are one time use and can be written down or saved on a cloud or other service if you lose the actual authentication. So there should be no excuses for anyone that does enable it and read the warnings to ever lose access to their account.
While it's not a rush with it being just social right now, if FN continues to develop the commissions system involving money, it's probably a good thing to allow this to be optional soon after that escrow system goes full force. I've never had an issue with getting into a system even when my phone died because I had all the same secrets scanned into the desktop app as well protected by a master password to load the generator and it's actually saved me a few times when I had a shared password on less important throwaway sites since there was email notifications for security also checking that IP ranges didn't match the same country. So while it wasn't banking or important, it still prevented annoyance and time spent recovering and rebuilding site accounts.
This would be the most straightforward, not reliant on cookies so swapping browsers or devices would be easy to bookmark the domain. It would also be less UI clutter of having even more login form options and buttons, and less UI clutter of having more dropdown or navbar options.
I believe the second part to this for the 'artwork of a character' should fall under duplicate to that other 'crediting artists' post http://support.furrynetwork.com/topics/168-collab-submissions/ So if the character was tagged, it'd be no different having it in your gallery as if you uploaded it if you accept it, or if you reject possibly have reject-to-features which would be a 'features in' category instead of your actual gallery for separation.
Tagging is freeform, you can put whatever and make it a new tag by being the first to tag something with it, the downside is because of that even more freeform was FA's that got imported with the automation. When site goes live we need something like e621 that has ALIASes for tags, so after a while, putting one tag will sorta silently also include another tag. So someone would have to go through and sorta get a portal to start linking related tags.
Using your example, searching for "wip" should also give you images that are: work in progress, works in progress, work_in_progress, work-in-progress, works_in_progress, works-in-progress... On e621 it does because there's forwarded tags under an 'synonym' list.
We also immediately made searching on FurryNetwork trash by importing the shitty FA tags people used. It was too freeform without suggestions so people were doing jokes and sentences in the tags. Now there's tons of images with like "lol what am I even doing" as the keywords which clutters the autofill and aren't tagged at all with anything in the picture just as bad if not worse than having no tags at all.
Upon further ponder, I don't think a single image sheet is even the best way to go about this. It's what people did on FA because that was all they were permitted, they'd get in trouble if they uploaded 10 images back to back that were single close up shots of a YCH style sketch, lineart, solid fill, digital color, and backgrounded full piece just to be loose in gallery for linking.
Here, we have the afforded option of the loose files (icon, banner, current pricesheet) that don't show up in submissions in any place. So if there's no issue there, you should be able to do a neat form that has (+) buttons for adding another tier/type and the little (trash) icon for removing the entered row (or like custom profile fields). Each of those new added fields would have a title, description, starting price, checkbox for maturity, and then an image upload example.
This could result in a clean constant grid of tiles something like our feed or gallery does. Perhaps with a tweak of adding the tagging form features could do as some others here suggested and have a white/black list for searching for open commissioners, perhaps a (+)(-) of number of slots open on the page after that form was submitted and prettified (like the reorder v ^ arrows for custom profile fields when not in edit mode). As soon as you accept someones request it can automatically decrement that counter, and then when you complete it, it can increment or you can go back and do it manually (so that if it was a one time batch/iron artist, it doesn't keep renewing).
That sounds like a great addon to go hand in hand with the payment system for commissions. Haven't seen any information on if there'll be a wallet balance and then you can cash it out or if it will just deposit directly for each commission, which would mean tipping would be tons of tiny transactions hitting your credit/debit/bank... A bit inefficient than just storing values on the website, but then you get into legal issues of banking institutions and taxes and money laundering legal issues. Still if they could get it to work, a little button like where FLAG is that says TIP and then a tiny textbox appears for tipping a fixed amount or quick buttons for like a few cents to a few dollars (1c, 5c, 25c, 50c, $1, ___) or perhaps just last 5 recent tips you made as the quick buttons would be great for getting micro/custom tips. The smaller 'only a penny' tips could add up fast if you get thousands of views, and at that point even I would start tipping a little bit to really great pieces that they weren't even asking for it. Quantity over Quality of tips can be surprisingly effective!
The distraction aside, I agree, it's naive to assume that a convinient button makes any difference in theft. I much rather like one click to go to my download folder than to click to blow it up, rightclick to save dialog, save, and removing it would only make me aggravated by taking a step backward. The only reason to not let people download it easily (video and music is usually the far most protected on those other sites) is if there was advertisements or some other monetization involved, so driving the users back to the page for another ad impression is the main goal for the site owner as well as the content creator (ie. youtube profits, soundcloud/bandcamp upsell for higher quality audio) but at the same time, I listen to most of my music on portable devices, and if I can't download it to put on phone or tablet or mp3 player, then I'm likely to only listen once, which means you lose out on it being played out loud and someone going "Oh that's cool who's it by?" and you getting even more attention.
If you're able to do the "What's on your mind?" basic Post entry type, I see that being all you ever need if you @someone in that and it notifies them as an alert. It's public on your page, it'd become public on their page after they respond using the same mechanics already on your feed of 'so and so commented on:' type updates.
I wouldn't want notifications trigger when someone @'s you in a media description, maybe perhaps comments so you could bring someone in to the thread of a picture or something? I could see that being abused with people pasting in a thousand names to just draw attention then or spam instead of using Promote like they should for pushing to feeds. I think only in plain Post types would be best rollout or start and is closest thing to shouting, instead of going to their page to leave it on their page, you simply make a post on your own feed with an @someone and they'd see the thread and be able to comment back and forth...
As well as pretty much any android with an app. I did this for SoFurry, I search for some high rated stories or some by keywords and then open to tabs and go on a download spree clicking the link and closing the tab and have a download folder with tons of the epubs, then I just drag them all to android phone/tablet and read them on the 'bookshelves' at leisure. Very handy for offline or remote reading without having even a 'mobile friendly' webpage still making you scroll oddly and have excess formatting and not saving place if the screen cuts off sometimes. With all the features of this site though being live scrolling and pinging for notifications, that'd be a little bit of background data constantly hitting your connection.
Customer support service by UserEcho