[#1117] Never return reset_keys in user dicts

Like the user's password, there's never any reason for a user dict to
contain their reset key (even if the user dict is being generated for
the user herself or for a sysadmin)
[#1117] Add docstring and unit tests for ignore_missing validator