fix logic errors in password reset mechanism

* Use random hashes, rather than generating the same one per user
* Fix duplicate entry error when retrieving duplicate reset keys
* Form validation was checking for EmailAddress, while the reset logic was using user.email.  Standardize on user.email
* Make sure all appropriate variables are in the context for email rendering
* Fix language in the request acknowledgement template to reflect the use of a reset key