Send "lost password" emails when people say they've lost their password.

Added a new config parameter expectation: app.name. Site will barf if it's not set.