XSS on forgot password, also added missing validation (username & password)

1) Added captcha option for forgot password (default to TRUE)

2) XSS: not really an XSS, (its not stored in the DB), but still it breaks the HTML. This 
`$value = str_replace(array('\'', '"'), ' ', $value);`
should be done on all views that our outputing user input. Will update at some point.

Attack patern: 
`'"--></style></script><script>alert(0x0002FA)</script> `

3) Added a callback that checks if we have a valid username or password.