If email verification enabled, only allow password reset for users with verified emails