Password reset email: update wording
RSS/XML: fix broken default header url
Password reset: ratelimit by IP
Message icons: no orangered on mark-read pages