Allow recovery of password with email address only.

![Password recovery form](http://jbrt.org/ddg/new_pw_form.png)

You can use username or email to reset password. If you supply both, they must match.
Also, I assume this sanitizes the input as well?