Fixing email link injection bug

Several templates used a variable set by the user (the request host header).  This led to a vulnerability where an attacker could inject their domain name into these templates (i.e., activation emails).  This patch fixes this vulnerability.

LMS-532
Added flag for lms-specific functionality

Studio doesn't do email changes, thus has no email reset template; thus, we must disable password/email-reset related tests when running with studio settings