Fixing XSS issue in password reset notifications as reported in card #1934