Password recovery

For production, connect SMTP and send a signed reset token from the `password_resets` table. The table is included in the database script.