The global password reset and confirmation email forms previously
had no reCAPTCHA and could be abused. This adds reCAPTCHA to both
to reduce/prevent abuse.

Changelog: security