Remove requirement for email address on all Users

Except for users with a password (because they will need
this email address for forgotten passwords)
Implement forgotten password/reset password