Don't hardcode https protocol in password reset email.

Use http or https, depending on the value of `is_secure`.
This is similar to how links in some other email templates work.