Add logic to handle lost passwords

[morungos]

While the basic admin user can modify passwords, we really ought to be able to do features like lock accounts, and enable people to recover an account. We could also allow OpenID, which would probably be even more sensible.

[morungos]

See also #29