[RFC] When resetting password check that requested user is not expired and/or disabled

I'm just not sure about naming etc. (for sure error message needs to be polished).

This PR should fix: #965