Allow password reset via mobile OTP

[jace]

It is possible to have a user account that has a phone number (or claim) associated with it, but no email address.

The password reset form in such a case should (a) accept a phone number instead of an email address (apart from username), and (b) allow password reset after confirming a code sent to the user's phone.