Adds Flask-Security to flesh out the user login functionality.
The login page now has a "forgot password" link, which takes the user to a page where they can enter their email and get a reset link sent to them. When they click the link, it'll take them to a page where they can reset their password. When the password is reset, the user gets another email notifying them that the password was reset.
There's a working change password page at "/change" for logged-in users, but currently no link to it--seems like it belongs on some sort of "manage your account" page that we don't have right now. Changing your password also sends a notification email.
Flask-Security includes a bunch of role/permission features, so I replaced the existing role functionality with that. This shouldn't change anything from the user's perspective.
Flask-Security comes with functionality to register users and confirm their emails, but I left that disabled for now.
To do: override default Flask-Security forms for login/password reset/etc so that the labels can be translated (#237).