Four checks before shipping a password-reset email template

Separate email-copy promises, URL escaping, trusted destinations and client testing before integrating a reset template.