optionally hide failures to request password resets

Set HidePasswordResetErrors in RT config to make all password reset
requests look to the requestor as though they have successfully sent an
email. Thus an unauthorised visitor can't find out whether a given user
account exists or is disabled.
Version 1.00 releng
Version 1.01 releng