R1:59c931710100

Prevent mailing lists from being bin/auth recover'd

Summary:
Fixes T9610.

- We currently permit you to `bin/auth recover` users who can not establish web sessions (but this will never work). Prevent this.
- We don't emit a tailored error if you follow one of these links. Tailor the error.

Even with the first fix, you can still hit the second case by doing something like:

- Recover a normal user.
- Make them a mailing list in the DB.
- Follow the recovery link.

The original issue here was an…