Allow recovery of password with email address only.

![Password recovery form](http://jbrt.org/ddg/new_pw_form.png)

You can use username or email to reset password. If you supply both, they must match.
Should we verify the email address is of the correct form? e.g. with https://metacpan.org/pod/Email::Valid

Or is that done on the frontend?