Password reset

Currently if someone attempts to password reset an email address that hasn't been registered they get notified it's not a valid address, leading to a theoretically situation in which all members' email addresses could be harvested. This just returns a bogus message in the event the email wasn't a valid registered address.