New central config for Oauth providers

Is a struct overkill?  Maybe.
Nicer no-reset email

Explain to the user why we didn't reset their password.  This is
required because someone could change such a user's email without
knowing the user's current password and then request a reset for that
user.

Closes #1
Use Mandril as the email service

Should be able to stay in the free level, and they handle SPF and DKIM