don't notify users if the email address is found in the database for password reset

this would prevent people from entering email addresses to see if an account is registered.