Comment 2 for bug 1526543

The actual default behavior is that the config.tt2 setting for 'reset_password' = true. So one has to set the value to false and then test the application of the patch.

Having done that, it looks good, so I'm pushing it to master with backports to rel_2_9 and rel_2_8.

Thanks Dan and Remington!