Add HttpSessionEventPublisher listener
Without that the session destroyed event is never sent and the access
log is never updated.
Fix spelling
Add rough draft for a password reset workflow.
Use email as username