Sanitize email address when handling forgot password requests

[#74160792] https://www.pivotaltracker.com/story/show/74160792

Signed-off-by: Rob Gallagher <rgallagher@pivotallabs.com>
Password Resets assume the username is an email

Allows us to avoid unexpected behavior from email address
collisions

/password_resets now returns 409 CONFLICT when the user exists,
but does not have uaa origin

[#74160792] https://www.pivotaltracker.com/story/show/74160792

Signed-off-by: Rob Gallagher <rgallagher@pivotallabs.com>