Recover by email needs to allow anon access to its endpoints

endpoints/api/user.py

@@ -643,6 +643,7 @@ class Recovery(ApiResource):
   }
 
   @nickname('requestRecoveryEmail')
+  @anon_allowed
   @validate_json_request('RequestRecovery')
   def post(self):
     """ Request a password recovery email."""