Allow recovery of password with email address only.

![Password recovery form](http://jbrt.org/ddg/new_pw_form.png)

You can use username or email to reset password. If you supply both, they must match.
Should this be `type="email"`?

We could get really fancy and use something like `<input type="email" pattern="[^ @]*@[^ @]*" value="">`