Finish implementation of password recovery

[kparkov]

I don't know exactly hos much was implemented the first time around, but I think there is a store method and an endpoint - but I believe it is incomplete.

The way it should work is:

• Call GET /recovery/:email to ask for a recovery token.
• The token is set on the user, and the e-mail is sent. At this point we want it to point at a passwordRecoveryUrl set as an ENV var. We want to suffix the token as ${passwordRecoveryUrl}/${token}.
• Another endpoint, POST /recovery/:token, will take a { email: 'email', password: 'newPass' } body. If the token OR the e-mail does not match, it should return 404.

[slytter]

I think it was fixed by:
a58f4f7

[slytter]

and 96f26c4

[kparkov]

Clearly not fixed, as there are no password recovery methods anywhere.