Better error when setPrincipal() has bad arguments
renewSession() returns user, not principal
Add email field, email index
Add a record for recovering passwords
Add a flag to indicate that the server can support email
Add a link to recover password if there's a way to do that
Add some endpoints for recovery
Redirect if the user is already logged in

The login page will now redirect if you're already logged in.

Closes #576.

Closes #417.
Merge branch 'master' into recoverpassword
Handle password recovery

We can now handle password recovery. It'll re-instantiate the OAuth keys
in the browser, which means you'll stay logged in.

Closes #187.
Document the SMTP options.