Don't disclose whether or not the user exists

When requesting a password reset, return a success message that an email was sent if the account with that email exists. Just an added security measure.