Add a feature to collect e-mails and send out password reset e-mails.

This adds support for configuring and using mail servers, refactors the
CSRFTokenService to use a new TokenService (which is also used for reset
tokens), and adds per-user rate limiting to avoid flooding e-mails with
lots of reset messages.

We still need to implement the processing of the reset link and the view
that allows the reset token to be manually entered.