Oops, ORM::has() requires the table name as the alias, not the model
name.  Sigh.  Fixed.
Use HTTP_Exception::factory() where appropriate.  In a couple of places
in User_Controller_Password it looks like we were throwing a 503 by accident,
which makes no sense.  Changes those to 403s.