Add reset password exception for unconfirmed accounts

When a password reset is requested on an unconfirmed account, make it fail with an exception (it currently succeeds) because the requested account has not yet been confirmed.