Fixed #20079 -- Improve security of password reset tokens

Fixing patch from https://github.com/django/django/pull/1218, as that no longer cleanly applied to master. Replaced magic number for length of random suffix with UNUSABLE_PASSWORD_SUFFIX_LENGTH.