alt login permissions now assignable by role. use USERNAME_MAX_LENGTH constant. alt logins now work for password reset requests.

properly unset alt_login field to avoid entry into data column of user table. better validation -- alt_login and username cannot be changed to be identical, and user cannot change username to an existing alt_login name.