Disable "lost password" feature, breaks on "php -S"

PHP's built-in webserver doesn't reliably expose SCRIPT_NAME,
see https://github.com/silverstripe/silverstripe-framework/issues/2580.
This breaks URL routing on /Security/passwordsent/admin%40test.com