Allow recovery of password with email address only.

![Password recovery form](http://jbrt.org/ddg/new_pw_form.png)

You can use username or email to reset password. If you supply both, they must match.
Sanitise for? Emails have already been validated. If someone wants to act the fool here, it just won't find an account.