Check if user is active when requesting a password reset

[steinkel]

We should check users are active when they request a new password request, to prevent inactive users getting emails if they didn't register. Original ticket submitted was #269