dont provide indication of email existing in the database or not

this would prevent people from entering email addresses to see if an account is registered.
Merge pull request #660 from sob/master

don't notify users if the email address is found in the database for password reset