UserController: password reset request now always returns an ok message (to not reveal whether a user actually exists or not).