Add username display to the reset password form.
Don't log in / log out in the password reset flow.

This prevents using valid password reset tokens to force a logout CSRF,
as reported by Mathias Karlsson.
Don't log users out in the verify email flow.

Fixes logout CSRF reported by Mathias Karlsson.
Add X-XSS-Protection and X-Content-Type-Options headers.

As suggested by reporter Shahmeer Amir.
lib/strings.py: Fix a spelling error

The past tense of the verb "verify" is "verified," not "verfied."