Add password reset page and emails

Allow the user to reset their password if they forget it.
Use passport login and logout methods properly

The logout method can be called in the logout route to remove just the
bits of the session that relate to auth rather than wiping the whole
thing. Also the login method doesn't need to be wrapped in
passport.authenticate in the register and invite routes since we've
already got an account that we want to login.