Collect email address optionally for resetting password

[Eldemarkki]

We could allow the user to store one (or multiple?) emails in their profile, so that in case they forget their password, we can send a password-reset link to their email.

We should probably still use username-password auth, as changing that would be quite a big change.

We'd need some API to send the emails, we could ask if Testausserveri ry could pay for it. For local development, MailHog looks like a very useful tool.