Before it was lower-casing everything first which prevented users being
able to login if their email address contained capitals.  We now only
lower case the host part as this is case-insensitive.

Fixes #505

A basic security measure to ensure a user is aware if his/her account
gets compromised.  The email contains a link to the password reset form
which allows a new password to be set.

Fixes #436

Fixes #376

* Tests now split into more coherent modules
* Added IDs to forms to help WebTest
* Some refactoring along the way

With complete webtest for password resetting story.