Always allow username-based password reset

[pfaffman (Jay Pfaffman)]

@southpaw

that it’s the hide_email_address_taken site setting that, when enabled, (and as noted by @moin, this setting is enabled by default) requires the forgot password form to accept only the full email address.

That’s new. How is it helping? Were people harassing people by sending password resets? It’s quite common for users on old communities not to know what email address they subscribed with.