Fixed #20079 -- Improve security of password reset tokens

Improvement of https://github.com/django/django/pull/1170 with comments in https://code.djangoproject.com/ticket/20079#comment:8

The use of UNUSABLE_PASSWORD_PREFIX is now limited to the auth hashers, and one case in the auth forms, where we need to make the distinction between an unusable password, and a password hashed with an unknown algorithm (is_usable_password will just return False for either situation).