Forgot password.

The real auth base is now in place, but password reset is still a placeholder until we wire email delivery and reset tokens.