Should require email and/or username, send forgot-password email. Configure SMTP mailer with env vars.