Send same confirmation message for all forgotpw requests.

This is to prevent username enumeration.
Limits on password reset.

5 per session.
Only mail a user again 5 mins after last request.