Do not leak enrollment info via password reset form

Hello,

Currently the default password reset form can be used to determine when an email address is enrolled in a site. While the `password_reset` view is customizable, I think this lack of confidentiality is a bad default, so I've offered a tiny fix (with test!) that ensures no enrollment information is leaked. Now it requires customization to violate confidentiality, instead of requiring customization to uphold it.

I believe this change fixes https://code.djangoproject.com/ticket/19758 

Cheers,

Kenn