User tweaks

Moved password validation to User object.
Moved some strings to properties.
UserReset is a custom password reset form, works better than using
AjaxPassView, since different roles of AjaxPassView are probably too
different to fit neatly into one view.