Make PasswordsController#create case-insensitive

* Centralize email normalization logic in `User.normalize_email`.
* Implement `User.find_by_normalized_email`.