Minor improvements in the UX of forgot password

# Problem

Here are some brief ideas on how to improve the UX of the forgot password feature, from a conversation with @snewcomer:

## Ideas
- [ ] tell the user when that email isn’t registered
- [ ] allow it to be reset by username or email (similar to existing issue to allow login by either)
- [ ] `/password/reset` could redirect to `/password/forgot` if there were no code supplied, with an error message
- [ ] `/password/reset` could redirect to `/password/forgot` if the code were expired, with an error message
- [ ] `/password/reset` could show the success message on that page itself, and then have a button to “continue to sign in” (which then does the auto-authentication)