Reset password via email

It should be possible for a user that has lost his password to reset it via an email loop.

This entails several tasks:
- Acquiring user email - should it be required? should it replace user name?
- Actually sending a lost password email
- Validating the link and allowing the password reset

The issue names no files, tests, or entry points. Start by clarifying whether email is required or replaces the username, then trace the existing user and password flows. Done means acquiring the email, sending a lost-password message, validating its link, and allowing the password to be reset.

Written by the indexing model from the issue text.