password reset only for user with password

Without this a user without a password, who can't login, can get an reset token
and then renerate an password which enables him to login.
This gives the control which users can login out of the hand of the RT admin
and is a kind if privilege escalation.
update description after 45f62e0