Further simplify web.config and add global exception handling.

Moved NLog out of web.config to web.nlog to avoid collisions with NLog
usage in parent web applications. Removed old validation flags and
directly access unvalidated form data where necessary. Removed stuff
that is no longer needed in web.config. Added global exception handling
to log when errors occur.
Add user creation validation and login with email.

User creation is now validated. Invalid fields should no longer be
able to create users. Additionally, allow users to login using their
username or email address since it's easy to forget which is which.