Limit password reset to only active users.

fixes #3542
- Check whether user is active on pw reset