added disable lost password feature

On my own sites some botnets attack the lost password URL directly.
Thus in an effort to kick every last botnet to the curb and to go full
circle with true passwordless log in, I added a feature that, when the
user selects the option to force clef, password resets are disabled.