Use hash_equals() for old md5 hashes.

Merges [30412] to the 3.9 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/3.9@30414 602fd350-edb4-49c9-b593-d223f7449a82
Form validation for password resets.

Merges [30417] to the 3.9 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/3.9@30419 602fd350-edb4-49c9-b593-d223f7449a82