simplify, clean up, and secure

Simplified the settings page by (1) moving the API message beneath the
API settings header, (2) merging the two password settings sections,
(3) re-writing the password settings instructions.

Cleaned up my additions by using empty() where appropriate and by using
the API's built-in message system to display login errors.

Discovered slight security bug: when user has "disable passwords for
clef users" selected, he may nevertheless run the default lost password
reset. Even though exploiting this hole would require access to the
user's e-mail account, I think lost password resets should be disabled
for Clef users when this option is selected. Applied temporary fix for
the time being (i.e., when the option is selected, password resets are
disabled for all users).