Raise correct event in ResetPassword -- let the notification service decide how to craft the message to user if account is not verified
add RequirePasswordReset flag to UserAccount