Add password reset support

[don-smith]

This will require asking for more information from the user, such as a question only they can answer. Their answer (and potentially the question) should be stored encrypted. Will also need their email address (or potentially, eventually SMS) to send them their password reset key.

This will also require creating password reset keys, which should also be stored encrypted and have an expiry.